Presto Player CVE-2026-45442

Exploitation requires a valid WordPress user account with at minimum Subscriber-level privileges (confirmed by CVSS PR:L - low privileges required). Network access to the WordPress installation is necessary (CVSS AV:N). No user interaction from an administrator or privileged user is needed once the attacker is authenticated (CVSS UI:N). The vulnerability is present in default installations of Presto Player through 4.1.3 without requiring any non-default configuration. Exploitation is limited by the authentication prerequisite - sites that disable open user registration and have no untrusted authenticated users face significantly reduced realistic risk. The impact is further bounded to read-only confidentiality exposure (C:L, I:N, A:N), restricting the damage to unauthorized access to content rather than site compromise.

The CVSS base score of 4.3 (Medium) accurately reflects a bounded risk: network-accessible (AV:N) with low complexity (AC:L) but requiring a valid low-privilege account (PR:L) - meaning anonymous exploitation is not possible. The only impact is low confidentiality (C:L) with no integrity or availability consequence, which caps real-world damage to unauthorized read access of protected video content or player configuration data. No EPSS score was provided in the available intelligence, preventing probabilistic exploitation forecasting. The vulnerability is absent from the CISA KEV catalog and no proof-of-concept code has been identified, suggesting opportunistic mass exploitation is not currently occurring. The 'Authentication Bypass' tag applied by Patchstack may be slightly misleading - the CVSS PR:L vector confirms authentication IS required; what is bypassed is the authorization layer within an already-authenticated session. Overall, this is a genuine but lower-priority finding appropriate for patch-cycle remediation rather than emergency response, unless the WordPress instance hosts sensitive or premium-gated video content where unauthorized access would be materially harmful.

An attacker registers or obtains a low-privilege WordPress account (e.g., Subscriber role, which many sites allow freely) on a site running Presto Player 4.1.3 or earlier. The attacker then crafts an HTTP request directly to the unprotected Presto Player endpoint - bypassing the missing authorization check - and retrieves video content, player settings, or restricted media data that should require elevated privileges to access. No public proof-of-concept exploit code has been identified at time of analysis, though the Patchstack report provides sufficient technical detail for manual reproduction.