CVE-2026-27333

Name of the Vulnerable Software and Affected Versions Paid Videochat Turnkey Site versions prior to 7.3.24

Description Unauthenticated PHP Object Injection occurs due to the deserialization of untrusted data. This issue allows an unauthenticated attacker to inject a PHP Object. The impact depends on the presence of a POP chain (a sequence of gadgets used to achieve code execution or other malicious actions) within other installed plugins or themes. If such a chain exists, it could lead to the deletion of arbitrary files, retrieval of sensitive data, or remote code execution.

Recommendations Update to a version newer than 7.3.23.