The Broadcast Live Video plugin contains a missing authorization flaw that permits users with insufficient privileges to reach content or actions that should be protected. This means an attacker can view, control, or otherwise interact with live streams that are intended for authenticated or role‑restricted audiences, effectively bypassing the intended access control policy.

WordPress sites running the VideoWhisper.com Broadcast Live Video plugin up through version 7.3.6 are vulnerable. The issue originates in the plugin handling of access control security levels and affects all installations where those levels are set incorrectly or left at default values.

The CVSS score of 4.3 indicates medium severity, and the EPSS score is not available, suggesting that no current knowledge of widespread exploitation exists. The vulnerability is not listed in the CISA KEV catalogue. Based on the plugin’s web‑based nature, the likely attack vector is a remote attacker who can send crafted requests to the WordPress instance, though local users with plugin access could also exploit it if the configuration is mis‑set.