Privilege Escalation in Paid Videochat Turnkey Site for WordPress

CVE-2025-8899

What is CVE-2025-8899?

The Paid Videochat Turnkey Site – HTML5 PPV Live Webcams plugin for WordPress has a security flaw that allows an authenticated attacker with Author-level access or higher to control user role assignments during account registration. This vulnerability arises from the videowhisper_register_form() function's failure to restrict role settings. By exploiting this weakness, attackers can submit forms to create new accounts with administrator roles, posing a serious risk to site integrity. Although contributors could also attempt this exploit, success depends on the unwarranted approval by an existing administrator, making it a considerably less likely scenario.

References