CVE Intelligence
Analysis AI-assisted

CVE-2026-57331: Paid Videochat Turnkey Site (WordPress Plugin) Arbitrary File Deletion via Path Traversal

CVE-2026-57331 is a critical arbitrary file deletion issue in the Paid Videochat Turnkey Site plugin, described as affecting versions up to and including 7.4.8. The CNA Patchstack scored it 9.9 under CVSS 3.1 and classified it as path traversal (CWE-22). The record shows no KEV listing and no confirmed exploitation in the sources consulted, and it lists no fixed version.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The CNA Patchstack reports an arbitrary file deletion issue in the Paid Videochat Turnkey Site WordPress plugin, affecting versions up to and including 7.4.8. The weakness is classified as path traversal (CWE-22), and the record labels the deletion capability as performer-related.

Impact

  • The CVSS 3.1 vector indicates network reachability, low privileges required, no user interaction and a changed scope.
  • Confidentiality, integrity and availability are each rated High in the single recorded score of 9.9.
  • Inference: an account with the performer role may be able to delete files outside the intended location, which could disrupt site operation or damage application data.

Affected products and versions

  • The description states that versions up to and including 7.4.8 are affected.
  • The structured affected list in the record is empty, so exact version ranges should be confirmed against the vendor advisory.
  • No fixed version appears in the record. Its absence does not establish that no fix exists.

Exploitation status

  • The record shows this CVE is not listed in the CISA KEV catalog.
  • No confirmed exploitation appears in the sources consulted.
  • The recorded EPSS probability is 0.00548 with a percentile of 0.44354.

Remediation and mitigation

  • Check whether the plugin is installed and which version is in use. Treat 7.4.8 and earlier as in scope based on the description.
  • Apply a vendor update when one is available, and confirm it against the Patchstack advisory.
  • Until a verified fix is in place, review which accounts hold the performer role and restrict or remove unnecessary access.
  • Maintain current backups of site files and the database, and limit web server file permissions where practical.

Detection guidance

  • Review logs for unexpected removal of media, theme or plugin files, and for unusual activity from performer accounts.
  • Monitor file integrity in the web root and upload directories for missing or altered files.

Limitations of the available information

  • The record has no fixed version, no structured affected products or versions, and no vendor details beyond the description.
  • The record's source status is Deferred.
  • Only one CVSS score is recorded, and it comes from the CNA.

Frequently asked questions

Which versions of the Paid Videochat Turnkey Site plugin are described as affected?

The description states versions up to and including 7.4.8. The structured affected list in the record is empty, so confirm exact ranges with the vendor advisory.

Is CVE-2026-57331 known to be actively exploited?

The record shows it is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.