PT-2026-130659
CVE-2026-85007
·
Published
2026-10-29
·
Updated
2026-10-29
Description by
CVSS 3.1
3.8
LowMetricsAV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
The Video Player for YouTube WordPress plugin before 2.1.4 does not perform a capability check on its player-preset AJAX handler, allowing users with the Contributor role and above to read the site-wide player-preset configuration, and in versions before 2.1.1 to modify and delete it as well.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾