The vulnerability is a missing authorization flaw that allows attackers to perform actions beyond their intended permissions. This broken access control can expose private video streams or enable modification of streaming settings, impacting confidentiality and integrity of the content served by the plugin.

Any WordPress site that installed VideoWhisper.com's Broadcast Live Video plugin with a version equal to or earlier than 7.3.7 is affected. The issue does not affect later releases such as 7.3.8 and above.

The CVSS score of 5.3 indicates moderate severity, and the absence of an EPSS score means the exploitation probability is unknown. The vulnerability is not listed in CISA's KEV catalog. Based on the description of missing authorization, the likely attack vector is through the plugin’s exposed HTTP endpoints or admin‐side APIs, where an attacker can leverage the lack of proper role checks to gain unauthorized access. This can occur without needing user credentials, meaning even unauthenticated users may be able to exploit it if the endpoints are publicly reachable.