What is the CVSS score of CVE-2026-27422?

CVE-2026-27422 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

YT Player CVE-2026-27422

Q: Which versions of YT Player are affected by CVE-2026-27422?

Broken access control in the YT Player WordPress plugin (versions <= 2.0.9) permits unauthenticated remote attackers to invoke restricted plugin actions without any authorization check.

EUVD-2026-48160 MEDIUM

Missing Authorization (CWE-862)

2026-07-23 Patchstack

GHSA-f48m-3fq9-h79w

WordPress Authentication Bypass Wordpress Plugin Yt Player Bplugins

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable unauthenticated endpoint with no complexity; integrity-only impact, no confidentiality or availability consequence, scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:04 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in YT Player <= 2.0.9 versions.

AnalysisAI

Broken access control in the YT Player WordPress plugin (versions <= 2.0.9) permits unauthenticated remote attackers to invoke restricted plugin actions without any authorization check. The flaw, rooted in a missing authorization gate (CWE-862), allows network-accessible exploitation with no user interaction required, resulting in unauthorized modification of plugin-controlled data or settings (CVSS 5.3 Medium). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Technical ContextAI

The YT Player plugin (CPE: cpe:2.3:a:bplugins:yt_player:*:*:*:*:*:*:*:*) is a WordPress plugin by bplugins for embedding YouTube video players. CWE-862 (Missing Authorization) identifies the root cause: one or more plugin action handlers - likely registered via WordPress AJAX hooks (wp_ajax_nopriv_*) or REST API endpoints - fail to verify whether the requesting party holds the required capability or nonce before executing the action. In WordPress, improper use of nopriv hooks or unprotected REST routes is a common pattern that exposes administrative functions to unauthenticated callers. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the affected endpoint is reachable over the network with no prior authentication, and the Integrity:Low impact indicates the attacker can alter some plugin-managed data, though scope is contained (S:U).

RemediationAI

The primary remediation is to update the YT Player plugin beyond version 2.0.9; check the WordPress plugin repository or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/yt-player/vulnerability/wordpress-yt-player-plugin-2-0-9-broken-access-control-vulnerability for the confirmed patched release. Note: the exact fix version is not independently confirmed in the available data - verify against the plugin changelog before deploying. If an immediate update is not feasible, a compensating control is to deactivate the plugin entirely, which removes the exposed endpoint; however, this disables YouTube embedding site-wide. Alternatively, a WAF rule blocking unexpected POST requests to the plugin's AJAX or REST action slug can reduce exposure, though this requires identifying the specific action name from plugin source code. WordPress site administrators should also ensure the principle of least privilege is applied and audit other installed plugins for similar nopriv hook misuse.