CVE-2026-27053: WordPress Broadcast Live Video plugin < 7.1.3 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection is an unauthenticated remote code execution class of vulnerability affecting the Broadcast Live Video WordPress plugin by VideoWhisper.com in versions below 7.1.3. The CVSS vector shows the vulnerability is reachable over the network with no authentication and no user interaction required. Successful exploitation gives an attacker full confidentiality, integrity, and availability impact on the host, enabling arbitrary code execution, data theft, or complete service takeover. A patched-image rebuild at version 7.1.3 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the WordPress installation via HTTP or HTTPS.

• AuthenticationNot required

  No account or session token is needed; the injection can be triggered by any unauthenticated HTTP request.

• Victim interactionNot required

  No victim action such as clicking a link or visiting a page is required for the attack to succeed.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and repeatable without depending on race conditions, memory layout, or other environmental factors.

Blast Radius

• Reads arbitrary files on the server, including WordPress configuration files containing database credentials and secret keys.
• Writes or modifies files on the server, enabling an attacker to plant malicious code or alter existing application logic.
• Executes arbitrary operating system commands under the web server process account, giving the attacker a foothold on the host.
• Crashes or degrades the WordPress service, resulting in full denial of service for site visitors and administrators.