CVE-2025-62959CWE-94code-injection

CVE-2025-62959

Critical · published October 27, 2025

CVSS v3.1
9.1
EPSS
0%
Percentile
38.7
In the wild
Unconfirmed
What it is

🔥 A remote code inclusion vulnerability in the Paid Videochat Turnkey Site could let attackers run any code they want — imagine your app suddenly taking orders from an uninvited guest! Think of it like a restaurant where the chef doesn’t check the orders — an unverified dish could end up serving anything from a gourmet meal to a mystery meat surprise. In this case, an attacker can exploit this oversight to cook up malicious code right in your system! This vulnerability could be absolutely devastating, allowing attackers to execute arbitrary commands on your server. They could hijack your application, access sensitive data, or even take control of the entire system. The consequences could be catastrophic, not only for the affected service but also for your users' trust!

Put simply

Think of it like a restaurant where the chef doesn’t check the orders — an unverified dish could end up serving anything from a gourmet meal to a mystery meat surprise. In this case, an attacker can exploit this oversight to cook up malicious code right in your system! The improper control of code generation in videowhisper's Paid Videochat software allows attackers to inject and execute arbitrary code, compromising the integrity of the application. This issue affects versions from an unknown release up to and including 7.3.23, opening the door wide for potential exploits.

What to do

This vulnerability could be absolutely devastating, allowing attackers to execute arbitrary commands on your server. They could hijack your application, access sensitive data, or even take control of the entire system. The consequences could be catastrophic, not only for the affected service but also for your users' trust! Immediate action is crucial! Update your Paid Videochat Turnkey Site to the latest version to close this critical vulnerability. Additionally, review and tighten input validation to prevent malicious code from slipping in. Don't forget to audit your code for any other potential security gaps! You've got this! Stay vigilant and proactive, and your security hero status is activated! 🛡️

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00458 · 38.7th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2025-10-27T06:15Z
References (1)
EPSS history
Timeline
  • 27 OCT 01:34Z
    WordPress Paid Videochat Turnkey Site plugin <= 7.3.23 - Remote Code Execution (RCE) vulnerability
    cvelistv5