CVE-2026-57331 CVE Vulnerability Disclosures / 8h Performer Arbitrary File Deletion in Paid Videochat Turnkey Site <= 7.4.8 versions.

Back cve.report

CVE-2026-57331 CVE Vulnerability Disclosures / 8h Performer Arbitrary File Deletion in Paid Videochat Turnkey Site <= 7.4.8 versions.

cve.report • June 29, 2026

Share: View original

Problem Types: CWE-22 | CWE-22 CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CNA: endy | Patchstack Bug Bounty Program (en)

CNA: Update the WordPress Paid Videochat Turnkey Site Plugin to the latest available version (at least 7.4.9).

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical CVE-2026-57331 Allows Arbitrary File Deletion in Videochat Plugin CVE-2026-57331, published on June 29, 2026, reveals a critical vulnerability in the Paid Videochat Turnkey Site Plugin versions 7.4.8 and earlier. This flaw, categorized as a path traversal issue (CWE-22), allows authenticated users with performer privileges to delete arbitrary files on the system. The potential impact includes data loss and service disruption, with a CVSS score of 9.9 indicating severe risk. Currently, there is no public proof-of-concept or evidence of exploitation, but immediate updates to version 7.4.9 or later are recommended. Security advisories have been issued, urging users to restrict performer account permissions and monitor file system activity. The vulnerability affects users of the Paid Videochat Turnkey Site Plugin on WordPress. Organizations are advised to audit performer account access logs to mitigate risks. 1 sources 73

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

CWE-22 - Path Traversal

Platforms (1)