Presto Player Pro CVE-2026-66481

Requires an authenticated account with at least Author-level privileges on a WordPress site running Presto Player Pro version 3.0.1 or earlier; the attacker then supplies a traversal path to a plugin file-handling function to delete files outside the intended scope. The main limiting factor is this privilege prerequisite - sites without untrusted Author accounts or open author-tier registration face substantially lower exposure. Note the input CVSS lists PR:H (admin-level), but the vulnerability title states 'Author' (a lower role); defenders should treat Author access as the realistic prerequisite and verify with the vendor.

This is a moderate-severity, authenticated path traversal (CWE-22) leading to arbitrary file deletion, scored CVSS 6.8 by Patchstack. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:C) indicates a remotely reachable, low-complexity flaw with a scope change, but it is gated behind privileged access. No EPSS score, CISA KEV listing, or public POC was provided, so there is no public exploit identified at time of analysis and no evidence of active or at-scale exploitation. The practical risk is bounded primarily by the privilege requirement: the title explicitly says 'Author' role, and WordPress Author is a mid-level, non-administrative role - which conflicts with the input vector's PR:H. This discrepancy matters, because PR:H implies admin-equivalent access (where arbitrary file deletion is far less impactful since an admin already has broad control), whereas an Author-level flaw is a genuine privilege-boundary violation and more noteworthy. Overall this reads as a real-but-not-urgent issue: it requires a foothold account on the target site and there is no exploitation-probability data elevating it, so it should be patched in routine cycles rather than treated as an emergency.

An attacker who holds (or obtains via open registration/compromise) an Author-level account on a WordPress site running Presto Player Pro <= 3.0.1 sends a crafted request to the vulnerable plugin endpoint containing a traversal path, causing deletion of an arbitrary file outside the intended directory. Deleting a critical file such as wp-config.php can knock the site offline or force a reinstall flow that an attacker could abuse. No public exploit code was identified in the provided data.