Missing authorization in the Paid Videochat Turnkey Site plugin allows attackers to exploit incorrectly configured access control security levels. The flaw, identified as a missing authorization weakness (CWE‑862), lets unauthenticated or lower‑privileged users access protected plugin functionalities, potentially enabling unauthorized control over video‑chat features and data.

The vulnerability affects the VideoWhisper.com Paid Videochat Turnkey Site WordPress plugin versions up to and including 7.5.12. Users running any of these versions on their WordPress sites are susceptible.

The CVSS score of 7.3 indicates a high‑severity risk, and the EPSS score of less than 1% indicates a low probability of exploitation, though the lack of CISA KEV listing does not eliminate exploitation potential. Attackers can trigger the flaw by sending requests to privileged plugin endpoints that lack proper access checks, so any web‑accessible WordPress installation running the affected plugin is at risk. Mitigation depends on applying the vendor’s patch, which removes the unchecked access paths.