# Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP <= 7.3.13 - Unauthenticated Insecure Direct Object Reference to Videochat Session Hijacking

- **ID:** WPSEC-2026-2402
- **Plugin:** Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP (`videowhisper-live-streaming-integration`), https://wordpress.org/plugins/videowhisper-live-streaming-integration/
- **Affected versions:** all versions before 7.3.14
- **Fixed in:** 7.3.14 (Update to 7.3.14 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/videowhisper-live-streaming-integration
- **Fix released:** 2026-11-02
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2402/

## Description

The Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP plugin for WordPress is vulnerable to Insecure Direct Object Reference via the HTML5 videochat session handling in all versions up to, and including, 7.3.13. This is due to missing ownership validation when sessions are resolved. sessionUpdate() reuses an existing session row matched only by the participant name, and for guests that name comes from the attacker-controlled 'htmlchat_username' cookie. sessionKey() and sessionValid() then accept the row without binding it to the requesting user or browser. This makes it possible for unauthenticated attackers who know a guest participant's name, which is shown in the room's user list, to get that guest's session ID and session key printed on their own room page, take over the guest's videochat session and act as that participant.

## References

- https://wpsec.com/vuln/WPSEC-2026-2402/
- https://plugins.svn.wordpress.org/videowhisper-live-streaming-integration/tags/7.3.14/
- https://wordpress.org/plugins/videowhisper-live-streaming-integration/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2402/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.