CVE-2026-24937 HIGH

CVE-2026-24937: WordPress Broadcast Live Video plugin < 7.1.3 - Remote Code Execution (RCE) vulnerability

Vendor Videowhisper.com
Product Broadcast Live Video
Weakness CWE-94 · Code injection
Published May 25, 2026
Last update May 26, 2026
View on NVD All CVEs

CVSS base score

7.2/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Improper Control of Generation of Code ('Code Injection') vulnerability in VideoWhisper.Com Broadcast Live Video allows Code Injection. This issue affects Broadcast Live Video: from n/a before 7.1.3.

Explanation of Vulnerability in Simple Terms

02Summary

Broadcast Live Video versions before 7.1.3 contain a code injection vulnerability that allows authenticated administrators to execute arbitrary PHP code on the server. An attacker with high-level administrative privileges can inject malicious code through unvalidated input, gaining full control over the site. This affects confidentiality, integrity, and availability of the entire installation.

What an attacker can do

03Attacker Capabilities

Run arbitrary PHP code on the server with full site access.

Potential impact on your site

04Site Impact

A compromised admin account can execute code, steal data, modify content, or take the site offline.

Conditions required to exploit

05Prerequisites

Attacker must have high-level administrative credentials for the Broadcast Live Video installation.

Key dates

06Disclosure timeline

May 25, 2026 CVE published
May 26, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2024-13785 Contact Form, Survey, Quiz & Popup Form Builder – ARForms <= 1.7.2 - Unauthenticated Blind Arbitrary Shortcode Execution CVE-2026-3352 Easy PHP Settings <= 1.0.4 - Authenticated (Administrator+) PHP Code Injection via 'wp_memory_limit' Setting CVE-2025-15463 Advanced Custom Fields: Extended <= 0.9.2.3 - Unauthenticated Arbitrary Shortcode Execution CVE-2026-32414 WordPress Advanced Woo Labels plugin <= 2.36 - Remote Code Execution (RCE) vulnerability CVE-2026-1560 Custom Block Builder – Lazy Blocks <= 4.2.0 - Authenticated (Contributor+) Remote Code Execution