Description

Missing Authorization vulnerability in VideoWhisper.com VideoWhisper Site Manager for ChatGPT, Claude, Codex videowhisper-site-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VideoWhisper Site Manager for ChatGPT, Claude, Codex: from n/a through 1.2.10.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-10-12T08:17:18.577Z",
  "pubdate": "2026-10-12T08:17:18.577Z",
  "executiveSummary": "The VideoWhisper Site Manager for ChatGPT, Claude, Codex plugin is susceptible to a Missing Authorization vulnerability, classified as an Improper Access Control issue.\nThis flaw enables unauthorized actors to perform actions reserved for higher-privileged users by exploiting incorrectly configured access control security levels.\nThe vulnerability affects versions n/a through 1.2.10 of the product.\nThe primary risk implications involve the potential for unauthorized administrative operations, data manipulation, or configuration changes within the target WordPress environment.\nSuccessful exploitation requires no specialized authentication or high-level credentials, as the underlying security checks are entirely absent or improperly enforced for sensitive plugin endpoints.\nBy bypassing standard authorization protocols, an attacker can influence the plugin's functionality or gain unauthorized control over site-managed features without satisfying the necessary security requirements.",
  "technicalDetails": "The vulnerability originates from a failure to implement robust access control mechanisms on administrative or sensitive functional endpoints within the VideoWhisper Site Manager plugin. In many WordPress plugins, authorization checks—typically performed via 'current_user_can()' or similar capabilities-based functions—are either missing, incorrectly configured, or absent from the request handling logic.\nBecause the plugin does not verify that the requester possesses the appropriate capabilities (such as 'manage_options' or other administrative privileges) before processing the request, the application treats unauthenticated or low-privileged requests as legitimate.\nThe attack flow typically involves an attacker identifying the specific API endpoints or AJAX handlers utilized by the Site Manager plugin. Once these endpoints are identified, an attacker can craft direct HTTP POST or GET requests targeting these functions. Since the server-side code fails to validate the authorization context, the plugin proceeds to execute the intended administrative functionality.\nThis behavior is consistent with Missing Authorization (CWE-862). The root cause is the reliance on client-side security or insufficient server-side validation during the transaction flow. When a request hits the vulnerable endpoint, the plugin logic does not perform a secure check to ensure the initiator is authorized to execute the specific operation.\nThe impact of this exploit is significant because it allows a malicious actor to perform unauthorized administrative actions, potentially leading to the modification of site configurations, plugin settings, or the manipulation of integration keys used for external AI services like ChatGPT, Claude, or Codex. Because the plugin manages site-level integrations, unauthorized access could be leveraged to exfiltrate sensitive data or disrupt service availability.\nGiven that the vulnerability exists within the request-handling component of the plugin, the exposure is network-based; any actor capable of reaching the web server can attempt to interact with these insecure endpoints. There is no requirement for a pre-existing authenticated session to exploit this flaw, making it a critical risk for site administrators running affected versions from 1.2.10 and earlier."
}