Videowhisper Paid Videochat Turnkey Site Path Traversal Vulnerability

A path traversal vulnerability has been identified in the Videowhisper Paid Videochat Turnkey Site, affecting versions through 7.2.12. This vulnerability allows for improper limitation of a pathname to a restricted directory, potentially leading to arbitrary file deletion.

Impact

Exploitation of this vulnerability could allow a malicious actor to delete arbitrary files from the server, including core files, which could disrupt the functionality of the website.

Remediation

Users of the Videowhisper Paid Videochat Turnkey Site should update to version 7.3 or later. Patchstack users can enable auto-update for vulnerable plugins.