VulnSocial

CVE-2025-8899Disclosure

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

The Paid Videochat Turnkey Site – HTML5 PPV Live Webcams plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.3.20. This is due to videowhisper_register_form() function not restricting user roles that can be set during registration. This makes it possible for authenticated attackers, with Author-level access and above, to create posts/pages with the registration form and administrator set as the role and subsequently use that form to register an administrator account. This can also be exploited by contributors, but is far less likely to be successful because an administrator would need to approve the form with the administrator role for the attack to be successful.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-269

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 5 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 4 signals
  • Disclosure: 3 classified signals
  • General: 1 classified signal
  • Peaked 1d ago at 4 mentions (2026-03-07); latest day: 1
  • 5 total mentions across 2 days

Deep dive

Activity timeline5 mentions / 2d
01234Mentions · 2026-03-07: 4Mentions · 2026-03-12: 1Patch / Workaround · 2026-03-07: 1Technical Details · 2026-03-07: 3Technical Details · 2026-03-12: 103-0703-12
Signal classification3 categories
Disclosure
360.0%
Patch
120.0%
General
120.0%
Referenced assets5 URLs
Classification over time
DateTotalLabels
2026-03-074
Disclosure3Patch1
2026-03-121
General1
Full discourse5 posts
  • CRAC Learning - Tech@cracbot
    General

    CVE-2025-8899 (CVSS:8.8, HIGH) is Awaiting Analysis. The Paid Videochat Turnkey Site – HTML5 PPV Live Webcams plugin for WordPress is vulnerable to Privilege Escalation in a..https://nvd.nist.gov/vuln/detail/CVE-2025-8899 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre

    Post summary

    The tweet reports a high‑severity WordPress plugin vulnerability (CVSS 8.8) with limited technical detail, awaiting formal analysis.

    0000066
    172 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2025-8899 The Paid Videochat Turnkey Site – HTML5 PPV Live Webcams plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.3.20. This i… https://www.cve.org/CVERecord?id=CVE-2025-8899

    Post summary

    CVE-2025-8899 reveals a privilege escalation flaw in the Paid Videochat WordPress plugin up to version 7.3.20, with no PoC, exploit, or patch information provided.

    00000223
    56.6K followersView on X
  • RedPacket Security@RedPacketSec
    Disclosure

    CVE Alert: CVE-2025-8899 - videowhisper - Paid Videochat Turnkey Site – HTML5 PPV Live Webcams - https://www.redpacketsecurity.com/cve-alert-cve-2025-8899-videowhisper-paid-videochat-turnkey-site-html5-ppv-live-webcams/ #OSINT #ThreatIntel #CyberSecurity #cve-2025-8899 #videowhisper #paid-videochat-turnkey-site-html5-ppv-live-webcams

    Post summary

    The text announces the existence of CVE‑2025‑8899 for Videowhisper's paid video‑chat platform, referring to a security alert link but providing no technical or exploitation details.

    00000251
    3.5K followersView on X
  • The Hacker Wire@TheHackerWire
    Disclosure

    🟠 CVE-2025-8899 - High The Paid Videochat Turnkey Site – HTML5 PPV Live Webcams plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.3.20. This is due to videowhisper_... https://www.thehackerwire.com/vulnerability/CVE-2025-8899/ https://t.co/8AZjBwQ3ye

    Post summary

    The post announces CVE-2025-8899, detailing a privilege escalation flaw in the Paid Videochat Turnkey Site plugin through version 7.3.20, but provides no PoC, exploit, patch, or evidence of active exploitation.

    00000194
    128 followersView on X
  • CVEFind.com@CveFindCom
    Patch

    [CVE-2025-8899: HIGH] Vulnerable WordPress plugin allows attackers to escalate privileges by registering as an admin without restrictions. Update to version 7.3.21 to secure your site.#cve,CVE-2025-8899,#cybersecurity https://cvefind.com/CVE-2025-8899

    Post summary

    A high‑severity privilege escalation vulnerability (CVE‑2025‑8899) in a WordPress plugin has been disclosed, with a clear patch available (v7.3.21).

    00000120
    599 followersView on X

Explore more

Back to dashboard