Broadcast Live Video: Arbitrary file deletion

Broadcast Live Video is affected by arbitrary file deletion. The vulnerable path is reachable without authentication. A successful request can remove files outside the intended scope and may make the site unavailable. The published affected range is n/a through 7.2.4.

CVE / CNA score 5.3 CVSS 3.1 · audit@patchstack.com

NVD score Pending NVD has not published its own CVSS assessment.

Component: Broadcast Live Video
Plugin slug: videowhisper-live-streaming-integration
Affected: n/a through 7.2.4
Safe version: 7.2.5
Published: Jul 23, 2026
Weakness: CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

This CVE was published Jul 23, 2026 and is one of 13 known issues for this plugin.

What to do

Patch or disable the affected component.

Update Broadcast Live Video to 7.2.5 or later, or disable and remove it until a fixed version is available.

Source record

Technical description

Unauthenticated Arbitrary File Deletion in Broadcast Live Video <= 7.2.4 versions.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

Patch or disable the affected component.

Technical description

Primary and upstream sources