{
 "id": "WPSEC-2026-2400",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2400/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2400/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2400/index.md",
 "title": "2Way VideoCalls and Random Chat – HTML5 Webcam Videochat <= 6.1.9 - Unauthenticated Sensitive Information Exposure via Session Listing Metadata",
 "description": "The 2Way VideoCalls and Random Chat – HTML5 Webcam Videochat plugin for WordPress is vulnerable to Sensitive Information Exposure via the room user list returned by the vw_2w_app AJAX action in versions 6.1.5 up to, and including, 6.1.9. This is due to the appRoomUsers() function returning the full stored metadata of every session in the room, including each session's application session key. This makes it possible for unauthenticated attackers who join a call or random-match room as a guest to collect the session keys of other guest participants and use them to impersonate those participants.",
 "plugin": {
  "slug": "webcam-2way-videochat",
  "name": "2Way VideoCalls and Random Chat – HTML5 Webcam Videochat",
  "full_name": "2Way VideoCalls and Random Chat – HTML5 Webcam Videochat",
  "wordpress_org": "https://wordpress.org/plugins/webcam-2way-videochat/",
  "advisories_url": "https://wpsec.com/vuln/plugin/webcam-2way-videochat/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/webcam-2way-videochat"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "6.1.5",
    "from_inclusive": true,
    "to": "6.1.10",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 6.1.5 before 6.1.10"
  ]
 },
 "introduced_in": "6.1.5",
 "fixed_in": "6.1.10",
 "remediation": "Update to 6.1.10 or later.",
 "fix_released": "2026-11-02T14:55:08+00:00",
 "published": "2026-11-03T15:50:58+00:00",
 "updated": "2026-11-03T13:23:20.643179+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2400/",
  "https://plugins.svn.wordpress.org/webcam-2way-videochat/tags/6.1.10/",
  "https://wordpress.org/plugins/webcam-2way-videochat/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/webcam-2way-videochat",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-11-03"
 }
}