{
 "id": "WPSEC-2026-2402",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2402/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2402/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2402/index.md",
 "title": "Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP <= 7.3.13 - Unauthenticated Insecure Direct Object Reference to Videochat Session Hijacking",
 "description": "The Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP plugin for WordPress is vulnerable to Insecure Direct Object Reference via the HTML5 videochat session handling in all versions up to, and including, 7.3.13. This is due to missing ownership validation when sessions are resolved. sessionUpdate() reuses an existing session row matched only by the participant name, and for guests that name comes from the attacker-controlled 'htmlchat_username' cookie. sessionKey() and sessionValid() then accept the row without binding it to the requesting user or browser. This makes it possible for unauthenticated attackers who know a guest participant's name, which is shown in the room's user list, to get that guest's session ID and session key printed on their own room page, take over the guest's videochat session and act as that participant.",
 "plugin": {
  "slug": "videowhisper-live-streaming-integration",
  "name": "Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP",
  "full_name": "Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP",
  "wordpress_org": "https://wordpress.org/plugins/videowhisper-live-streaming-integration/",
  "advisories_url": "https://wpsec.com/vuln/plugin/videowhisper-live-streaming-integration/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/videowhisper-live-streaming-integration"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "7.3.14",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 7.3.14"
  ]
 },
 "introduced_in": null,
 "fixed_in": "7.3.14",
 "remediation": "Update to 7.3.14 or later.",
 "fix_released": "2026-11-02T15:02:31+00:00",
 "published": "2026-11-03T15:50:58+00:00",
 "updated": "2026-11-03T13:23:06.650087+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2402/",
  "https://plugins.svn.wordpress.org/videowhisper-live-streaming-integration/tags/7.3.14/",
  "https://wordpress.org/plugins/videowhisper-live-streaming-integration/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/videowhisper-live-streaming-integration",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-11-03"
 }
}