The vulnerability is an Authentication Bypass flaw in the VideoWhisper.com 2Way VideoCalls and Random Chat WordPress plugin, allowing an attacker to abuse authentication controls and gain unauthorized access. Because the weakness lies in the primary authentication mechanism, an attacker could potentially access the plugin's privileged features without valid credentials, compromising confidentiality and integrity of the chat sessions. The weakness is classified as CWE‑305, representing Improper Authentication.

WordPress sites running the VideoWhisper.com 2Way VideoCalls and Random Chat plugin up to and including version 6.1.5 are affected. The plugin may be installed via WordPress plugin directories or directly from VideoWhisper.com.

The CVSS score of 6.5 indicates medium severity, and the EPSS score is not available, meaning the current exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV, suggesting no confirmed widespread exploitation yet. The likely attack vector is inferred to be remote via HTTP requests to the plugin’s endpoints, where authentication checks can be bypassed. If an attacker gains unauthenticated access, they can abuse the chat functionality and potentially leverage it to hijack user sessions or perform further actions without proper authentication.