The vulnerablility is a CSRF flaw in the Broadcast Live Video plugin that allows an attacker to trick an authenticated WordPress user into sending a request that performs an action on the site without the user's consent. The flaw can lead to unauthorized changes to the live‑stream configuration or other state‑changing operations carried out by the victim’s account, potentially compromising the integrity of streaming services.

The affected product is the WordPress plugin Broadcast Live Video from videowhisper, with all releases up to and including version 6.2.4 impacted.

The CVSS score of 4.3 indicates a moderate severity. The EPSS score of less than 1 % suggests a low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Though the flaw does not provide remote code execution, based on the description it is inferred that an attacker could exploit it via a crafted web request originating from a malicious page or phishing email. Successful exploitation requires the victim to be authenticated and thus is most impactful against users with elevated capabilities for stream management.