This vulnerability allows attackers to bypass normal authorization controls within the VideoWhisper.com 2Way VideoCalls and Random Chat plugin by exploiting incorrectly configured access control security levels. The missing authorization check can lead to unauthorized users executing plugin functionality they should not have access to, potentially exposing private user data or enabling further exploitation within the WordPress site. The affected area is the plugin itself; the impact remains confined to the plugin's permissions and does not spread beyond its functionality.

WordPress sites that have installed the VideoWhisper.com 2Way VideoCalls and Random Chat plugin in any version up through 6.1.9. The vulnerability spans all installations of the plugin from the earliest available version up to and including 6.1.9, regardless of other plugins or WordPress core versions.

The CVSS score of 5.3 classifies the issue as Medium severity, indicating a moderate risk when exploitation occurs. The EPSS score is not available, so the real-world exploitation likelihood cannot be inferred from that metric. The vulnerability is not listed in the CISA KEV catalogue, suggesting it has not yet been widely exploited in the wild. The attack vector is likely local or moderate remote, inferred from the description that the weakness results from misconfigured access control settings within the plugin. Exploitation would require configuration changes or an attacker who gains side‑channel access to the plugin’s settings to modify security levels.