Technical impact
The vulnerability is an Improper Control of Generation of Code, classified as code injection (CWE‑94). An attacker who can influence the plugin’s input could cause the plugin to execute arbitrary code on the server. This would allow full compromise of the website, compromising confidentiality, integrity, and availability. The description explicitly identifies it as Remote Code Inclusion.
Affected Systems
The affected product is Videowhisper Paid Videochat Turnkey Site (ppv‑live‑webcams). All versions from the initial release through version 7.3.23 are vulnerable. The software is commonly deployed on WordPress sites that host paid video chat services.
Risk and Exploitability
The CVSS score of 9.1 classifies the vulnerability as Critical, but the EPSS score of less than 1 % suggests a very low probability of exploitation at the moment. It is not listed in the CISA KEV catalog. The most likely attack vector is via HTTP requests that the plugin accepts, but the exact method is not detailed in the CVE; it is inferred that an authenticated or unauthenticated user could inject code through a vulnerable parameter.
