CVE-2025-62959: 
WordPress vulnerability analysis and mitigation

A Remote Code Execution (RCE) vulnerability was discovered in the WordPress plugin Paid Videochat Turnkey Site (ppv-live-webcams) versions 7.3.22 and below. The vulnerability, identified as CVE-2025-62959, was discovered on October 16, 2025, and publicly disclosed on October 29, 2025. This security flaw is related to improper control of code generation that could lead to code injection (Wordfence Intel, AttackerKB).

The vulnerability has been assigned a CVSS score of 7.2 (High), indicating its significant severity. The security flaw specifically relates to improper control of code generation that could potentially lead to code injection in the videowhisper Paid Videochat Turnkey Site ppv-live-webcams plugin (Wordfence Intel).

The vulnerability allows authenticated users with administrative privileges to execute arbitrary code on affected WordPress installations running the vulnerable plugin versions (Wordfence Intel).

As of October 23, 2025, the vulnerability remains unpatched. Website administrators running the affected plugin versions should consider implementing additional security measures or temporarily disabling the plugin until a patch becomes available (Wordfence Blog).