Paid Videochat Turnkey Site – HTML5 PPV Live Webcams <= 7.3.20 — Authenticated (Author+) Privilege Escalation

Am I affected?

• Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under Paid Videochat Turnkey Site – HTML5 PPV Live Webcams.
• No admin access? Run a passive check of your site. It reads public files only.

What to do

1. Update to version 7.3.21, or a newer patched version
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
3. Watch Paid Videochat Turnkey Site – HTML5 PPV Live Webcams to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to Peter Thaleikis.

The Paid Videochat Turnkey Site – HTML5 PPV Live Webcams plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.3.20. This is due to videowhisper_register_form() function not restricting user roles that can be set during registration. This makes it possible for authenticated attackers, with Author-level access and above, to create posts/pages with the registration form and administrator set as the role and subsequently use that form to register an administrator account. This can also be exploited by contributors, but is far less likely to be successful because an administrator would need to approve the form with the administrator role for the attack to be successful.

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

• Advisorywordfence.com

Related CVEs

Timeline

1. Mar 6, 2026

   CVE published

   Severity high, CVSS 8.8

2. Nov 13, 2026

   Record last updated