CVE-2026-27333: WordPress Paid Videochat Turnkey Site plugin <= 7.3.23 - Deserialization of untrusted data vulnerability

Synopsis

This is a deserialization-of-untrusted-data vulnerability in the Paid Videochat Turnkey Site WordPress plugin by VideoWhisper.com, affecting all versions up to and including 7.3.23. An unauthenticated attacker can reach the vulnerable endpoint over the network and supply a crafted serialized payload, with no login or user interaction required. Successful exploitation gives the attacker full read, write, and availability impact on the affected system, which typically means remote code execution or complete data compromise depending on available PHP gadget chains. No fix version has been published yet; HarborGuard tracks the upstream advisory and will make a patched-image rebuild available the moment a fix ships.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, meaning an attacker must be able to send HTTP requests to the WordPress installation to deliver a malicious serialized payload.

• AuthenticationNot required

  No account or session token is needed; the deserialization sink is reachable by any unauthenticated HTTP request.

• Victim interactionNot required

  The attack is fully server-side and requires no action from any user or administrator of the WordPress site.

• Attack complexityDetail

  Attack complexity is rated High, meaning exploitation is not trivially reliable and likely depends on environmental factors such as the presence of a suitable PHP gadget chain in the application's class scope or specific timing conditions.

Blast Radius

• A successful attacker can read any data accessible to the PHP process, including WordPress database credentials, stored user records, and session tokens.
• The attacker can write or modify files and database rows, enabling defacement, backdoor installation, or manipulation of site content and user data.
• The attacker can crash or make the WordPress service unavailable by corrupting application state or consuming server resources through the deserialized payload.
• Because WordPress often runs with broad filesystem permissions, exploitation can extend beyond the plugin itself to the entire web root and any co-located applications.