{
 "id": "WPSEC-2026-2399",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2399/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2399/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2399/index.md",
 "title": "2Way VideoCalls and Random Chat – HTML5 Webcam Videochat <= 6.1.9 - Unauthenticated Guest Videochat Session Hijacking",
 "description": "The 2Way VideoCalls and Random Chat – HTML5 Webcam Videochat plugin for WordPress is vulnerable to unauthorized access to guest videochat sessions in versions 6.1.5 up to, and including, 6.1.9. This is due to how the plugin finds an existing guest session when a call room is opened: it matches the session only by the guest username, which comes from a client-controlled cookie, and by an IP address read from spoofable request headers such as Client-IP and X-Forwarded-For. Guest sessions were never tied to the browser that created them. This makes it possible for unauthenticated attackers who know another guest's username and IP address to get that guest's application session key and act in the videochat room as that guest.",
 "plugin": {
  "slug": "webcam-2way-videochat",
  "name": "2Way VideoCalls and Random Chat – HTML5 Webcam Videochat",
  "full_name": "2Way VideoCalls and Random Chat – HTML5 Webcam Videochat",
  "wordpress_org": "https://wordpress.org/plugins/webcam-2way-videochat/",
  "advisories_url": "https://wpsec.com/vuln/plugin/webcam-2way-videochat/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/webcam-2way-videochat"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.8,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "6.1.5",
    "from_inclusive": true,
    "to": "6.1.10",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 6.1.5 before 6.1.10"
  ]
 },
 "introduced_in": "6.1.5",
 "fixed_in": "6.1.10",
 "remediation": "Update to 6.1.10 or later.",
 "fix_released": "2026-11-02T14:55:08+00:00",
 "published": "2026-11-03T15:50:58+00:00",
 "updated": "2026-11-03T13:23:20.643179+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2399/",
  "https://plugins.svn.wordpress.org/webcam-2way-videochat/tags/6.1.10/",
  "https://wordpress.org/plugins/webcam-2way-videochat/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/webcam-2way-videochat",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-11-03"
 }
}