Broadcast Live Video: Session fixation enables session hijacking
Summary
The WordPress plugin Broadcast Live Video (videowhisper-live-streaming-integration) by VideoWhisper.com contains a session fixation vulnerability (CWE-384) in versions up to and including 7.3.2. According to the CVE data, an unauthenticated attacker can take over a logged-in user's session and act as that user without knowing the password. The CVSS 3.1 score is 7.3 (network-reachable, no privileges or user interaction required). Patchstack rates the issue as high priority, but the sources reviewed show no confirmed exploitation.
Affected
- VideoWhisper.com Broadcast Live Video (WordPress plugin videowhisper-live-streaming-integration), versions up to and including 7.3.2
- Versions before 7.3.3 are considered affected according to the CNA record
Fixed in
- Update to version 7.3.3 or later (minimum according to the CNA record and Patchstack)
- Newer releases are available on wordpress.org; the listing shows versions beyond 7.3.3
Workaround
Unknown. The vendor has not published a workaround for this CVE. Updating is the recommended measure. After updating, ending existing sessions of logged-in users can be considered as general practice; this is not a vendor recommendation.
Exploitation
- CISA SSVC assessment: exploitation none, automatable yes, technical impact partial
- CISA KEV: not listed according to the sources reviewed
- No public proof of concept found in the sources reviewed
- Patchstack states that it expects exploitation and has deployed a mitigation rule
Our recommendation
- Check whether any WordPress site uses the Broadcast Live Video plugin, including test and staging systems
- Update the plugin to the latest version from wordpress.org (at least 7.3.3)
- After the update, consider ending existing user sessions
- Monitor logs for unusual logins and session activity
- Review the plugin's other published CVEs, as older releases may have further unpatched issues
- Confirm the affected range and fixed version against the Patchstack advisory and the NVD record, as the NVD status is currently Deferred
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory: Session Hijacking in Broadcast Live Video plugin patchstack.com
- CVE Program record (cvelistV5 release) github.com
- OSV entry AZL-107421 osv.dev
- Vulners VulnRichment: CVE-2026-107421 vulners.com
- Strix CVE details: CVE-2026-107421 www.strix.ai
- OffSeq radar: CVE-2026-107421 radar.offseq.com
- WordPress plugin listing: Broadcast Live Video wordpress.org
- WPScan plugin page: Broadcast Live Video wpscan.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 3 Nov 2026, 02:05.
Original description (NVD)
Session Fixation vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Session Hijacking.This issue affects Broadcast Live Video: from n/a through 7.3.2.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.