What is the CVSS score of CVE-2026-7544?

CVE-2026-7544 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Mux Video Uploader CVE-2026-7544

EUVD-2026-43128 MEDIUM

Information Exposure (CWE-200)

2026-07-11 Wordfence

GHSA-rqch-mf8g-6cqr

WordPress Information Disclosure Wordpress Plugin Mux Video Uploader

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-accessible via browser, low complexity; PR:L reflects mandatory subscriber authentication; no integrity or availability impact from credential read.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 11, 2026 - 03:58 vuln.today

CVE Published

Jul 11, 2026 - 02:31 cve.org

MEDIUM 4.3

DescriptionCVE.org

The Mux Video Uploader plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.4 via the muxvideo_enqueue_settings_script. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract sensitive data including Mux API credentials.

AnalysisAI

Sensitive Information Exposure in the Mux Video Uploader WordPress plugin (all versions through 1.1.4) allows any authenticated WordPress user at subscriber level or higher to retrieve Mux API credentials via the muxvideo_enqueue_settings_script function. Mux API keys exposed this way could enable unauthorized access to the site's Mux account, including video management and potential billing abuse. Reported by Wordfence; no public exploit code or CISA KEV listing identified at time of analysis.

Technical ContextAI

The affected plugin (CPE: cpe:2.3:a:2coders:mux_video_uploader:*:*:*:*:*:*:*:*) integrates WordPress sites with the Mux video API platform. The vulnerable function muxvideo_enqueue_settings_script - located at includes/functions.php around lines 668-672 - enqueues a JavaScript settings object into page output that improperly includes Mux API credentials (likely token ID and secret key). This is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): credentials intended for server-side use are passed to the client-side JavaScript layer where any logged-in user can read them from page source or browser developer tools. No special exploitation tooling is required beyond authenticated browser access.

RemediationAI

A patch has been committed to the WordPress plugin repository trunk per the referenced changeset (https://plugins.trac.wordpress.org/changeset?reponame=&old=3543763%402coders-integration-mux-video&new=3543763%402coders-integration-mux-video); however, the exact released version number containing this fix is not independently confirmed from the provided data - verify the current version in the WordPress plugin directory before updating. Site administrators should update to the latest version available beyond 1.1.4 via the WordPress admin plugins page. As an immediate compensating control, rotate the Mux API credentials (token ID and secret) in your Mux dashboard to invalidate any credentials that may have been exposed; this has no functional side effect beyond invalidating old keys. If immediate update is not possible, restricting WordPress subscriber registration or disabling public user registration will reduce the pool of potential attackers, though it does not eliminate risk for sites with existing subscriber accounts.