CVE-2026-110883— WordPress 2Way VideoCalls and Random Chat plugin <= 6.1.5 - Broken Authentication vulnerability
Quick assessment
Affected
VideoWhisper.com 2Way VideoCalls and Random Chat
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
VideoWhisper.com 的"2Way VideoCalls"和"Random Chat"网络摄像头双向视频聊天服务存在因主要弱点导致的身份验证绕过漏洞，该漏洞允许攻击者滥用身份验证机制。此问题影响"2Way VideoCalls"和"Random Chat"组件，受影响版本范围从未知版本至 6.1.5。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| VideoWhisper.com | 2Way VideoCalls and Random Chat | ≤ 6.1.5 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-110883
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WordPress 2Way VideoCalls and Random Chat plugin <= 6.1.5 - Broken Authentication vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Authentication Bypass by Primary Weakness vulnerability in VideoWhisper.com 2Way VideoCalls and Random Chat webcam-2way-videochat allows Authentication Abuse.This issue affects 2Way VideoCalls and Random Chat: from n/a through 6.1.5.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用基本弱点进行的认证绕过
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| VideoWhisper.com | 2Way VideoCalls and Random Chat | 0 ~ 6.1.5 | - |
|
II. Public POCs for CVE-2026-110883
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-110883
请登录查看更多情报信息。
Security Blog Posts for CVE-2026-110883 (1)
IV. Related Vulnerabilities
Same vendor: VideoWhisper.com
-
CVE-2026-107426
WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Bro -
CVE-2026-107421
WordPress Broadcast Live Video plugin <= 7.3.2 - Session Hij -
CVE-2026-107428
WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Cro -
CVE-2026-108475
WordPress Broadcast Live Video plugin <= 7.3.6 - Broken Acce -
CVE-2026-108476
WordPress Paid Videochat Turnkey Site plugin <= 7.5.13 - Bro
Same weakness: CWE-305
-
CVE-2026-111283
BMC Helix Network Management before 26.3.01 Authentication B -
CVE-2026-77185
Apache MINA SSHD: Asynchronous authentication can bypass sig -
CVE-2026-59563
HMAC Confirmation Token Unbinding in zscaler-mcp-server -
CVE-2026-88837
Busybox: busybox: httpd misidentifies yescrypt password hash -
CVE-2026-85500
`require_confirmed_with` is not enforced on the action and f
V. Comments for CVE-2026-110883
No comments yet