CVE-2026-57331: WordPress Paid Videochat Turnkey Site plugin <= 7.4.8 - Arbitrary File Deletion vulnerability

Synopsis

An arbitrary file deletion vulnerability affects the Paid Videochat Turnkey Site WordPress plugin at version 7.4.8 and below. The flaw is reachable over the network, requires only a low-privilege account (such as a performer account), and needs no interaction from other users. Successful exploitation lets an attacker delete arbitrary files on the host, which can destroy site content, remove security controls, or cause full service disruption alongside exposing or corrupting data. No fix version has been published yet; HarborGuard tracks the advisory and will make a patched rebuild available the moment upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, so an attacker must be able to reach the WordPress installation via standard HTTP/S to trigger the flaw.

• AuthenticationRequired

  A low-privilege account (for example, a registered performer account) is sufficient; no administrative credentials are needed.

• Victim interactionNot required

  The attacker can complete the exploit entirely on their own without any action from another user or an administrator.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race conditions, or environmental factors to succeed.

Blast Radius

• An attacker can delete arbitrary files on the web server, including WordPress core files, plugin files, and configuration files such as wp-config.php.
• Deleting wp-config.php or similar configuration files triggers a WordPress reinstallation flow, which an attacker can exploit to take over the site.
• Critical system or application files outside the web root may also be reachable depending on server permissions, potentially disabling security tooling or logging agents running in the container.
• Because the CVSS scope token is Changed, impact extends beyond the WordPress application itself, meaning other services or data stores co-located in the environment are at risk of disruption or exposure.