WordPress security changelog
CRITICAL CVE-2026-27053 Deferred

Broadcast Live Video: Code execution

Broadcast Live Video is affected by code execution. The vulnerable path is reachable without authentication. Successful exploitation can run attacker-controlled code in the WordPress hosting account. The published affected range is n/a to < 7.1.3.

CVE / CNA score 9.8 CVSS 3.1 · audit@patchstack.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
Broadcast Live Video
Plugin slug
videowhisper-live-streaming-integration
Affected
n/a to < 7.1.3
Safe version
7.1.3
Published
Jun 15, 2026
Weakness
CWE-502 — Deserialization of Untrusted Data

This CVE was published Jun 15, 2026 and is one of 13 known issues for this plugin.

What to do

Patch or disable the affected component.

Update Broadcast Live Video to 7.1.3 or later, or disable and remove it until a fixed version is available.

Source record

Technical description

Unauthenticated PHP Object Injection in Broadcast Live Video < 7.1.3 versions.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Primary and upstream sources