What is the CVSS score of CVE-2026-39485?

CVE-2026-39485 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Youtube Embed Plus CVE-2026-39485

EUVD-2026-20153 MEDIUM

Missing Authorization (CWE-862)

2026-04-08 Patchstack

GHSA-px56-fpc7-fx7f

Authentication Bypass Youtube Embed Plus

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 08, 2026 - 08:45 euvd

EUVD-2026-20153

Analysis Generated

Apr 08, 2026 - 08:45 vuln.today

CVE Published

Apr 08, 2026 - 08:30 nvd

MEDIUM 4.3

DescriptionCVE.org

Missing Authorization vulnerability in embedplus Youtube Embed Plus youtube-embed-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Youtube Embed Plus: from n/a through <= 14.2.4.

AnalysisAI

Missing authorization in embedplus Youtube Embed Plus plugin versions up to 14.2.4 allows authenticated users to access restricted functionality through incorrectly configured access controls, resulting in limited information disclosure. The vulnerability affects all installations of Youtube Embed Plus from version 0 through 14.2.4, requires authenticated access (PR:L), and carries low real-world risk with EPSS score of 0.02% (4th percentile) despite CVSS 4.3 rating.

Technical ContextAI

This is a broken access control vulnerability (CWE-862) in a WordPress plugin designed to embed YouTube content. The underlying issue stems from insufficient authorization checks when processing user requests-the application fails to properly validate whether an authenticated user has permission to access specific resources or perform certain actions. WordPress plugin vulnerabilities of this type typically occur when capability checks (wp_current_user_can() or similar functions) are omitted or improperly configured in admin-level functions or restricted features. The CPE identifier cpe:2.3:a:embedplus:youtube_embed_plus:*:*:*:*:*:*:*:* confirms this affects the Youtube Embed Plus plugin across all minor versions up to and including 14.2.4.

RemediationAI

Update Youtube Embed Plus to version 14.2.5 or later, which contains the corrected access control checks. Site administrators should navigate to WordPress Plugins > Installed Plugins, locate Youtube Embed Plus, and use the Update Now button to apply the fix. For sites where automatic updates are disabled, download version 14.2.5 or higher from the official WordPress plugin repository at wordpress.org/plugins/youtube-embed-plus/ and upload it manually via FTP or the WordPress Plugin Upload interface. Verify the update completed successfully and test embedded YouTube content functionality post-upgrade. Reference the advisory at https://patchstack.com/database/Wordpress/Plugin/youtube-embed-plus/vulnerability/wordpress-youtube-embed-plus-plugin-14-2-4-broken-access-control-vulnerability?_s_id=cve for additional technical details.