CVE-2026-57716
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
Broadcast Live Video plugin version 7.2.4 and earlier allows an unauthenticated attacker to arbitrarily delete files. The attacker can delete critical system files.
Risk Assessment
The organization may lose video data, configuration files, or the entire website, leading to complete loss of availability.
Recommendation
Immediately update the Broadcast Live Video plugin to a version above 7.2.4.
Other vulnerabilities in Broadcast Live Video
See all- CVE-2026-115963High
The Broadcast Live Video plugin by VideoWhisper.com contains a Missing Authorization vulnerability that allows Exploiting Incorrectly Configured Access Control Security Levels. The issue affects versions from n/a through 7.3.9.
- CVE-2026-27053Critical
In Broadcast Live Video versions below 7.1.3, there is a vulnerability to unauthenticated PHP object injection.
- CVE-2026-111839Medium
The Broadcast Live Video plugin up to version 7.3.7 contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthorized user may access functions requiring privileges.
- CVE-2026-107421High
The Broadcast Live Video plugin by VideoWhisper.com up to version 7.3.2 contains a Session Fixation vulnerability that allows session hijacking.
- CVE-2026-108475Medium
The Broadcast Live Video plugin by VideoWhisper.com up to version 7.3.6 contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels.
- CVE-2026-24937High
The Broadcast Live Video plugin by VideoWhisper.Com for WordPress before version 7.1.3 contains a Code Injection vulnerability. This allows an attacker to inject and execute arbitrary code.
Original NVD description (English source)
Unauthenticated Arbitrary File Deletion in Broadcast Live Video <= 7.2.4 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS