The Paid Videochat Turnkey Site – HTML5 PPV Live Webcams plugin for WordPress has a flaw that allows an authenticated user with Author or higher privileges to set a registration form’s target role to administrator. By creating such a form and then registering through it, the attacker can spawn an account with administrative rights. The vulnerability stems from unchecked role assignment in the videowhisper_register_form() function, representing an improper privilege management weakness (CWE‑269).

Any WordPress site running the Paid Videochat Turnkey Site – HTML5 PPV Live Webcams plugin version 7.3.20 or earlier is susceptible. Sites should verify the plugin version and update to a newer release if available. The vendor, videowhisper, offers the plugin under the name Paid Videochat Turnkey Site – HTML5 PPV Live Webcams.

The CVSS score of 8.8 indicates a high severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not currently listed in CISA's KEV catalog. Exploitation requires an account with Author or higher privileges, and the attacker must successfully configure a form that assigns the administrator role before using it to register. Once the form is deployed, the attacker can create an administrator account without further privileges. The attack vector is likely remote via the WordPress back‑end, and the attacker must have prior authenticated access to create forms.