FluentPlayer Pro CVE-2026-81272

Exploitation requires an authenticated WordPress session with at least Editor-level role permissions on the target installation - this is not a guest or subscriber-level attack. The vulnerability is specific to the FluentPlayer Pro plugin (not WordPress core or other plugins) and affects only versions 1.3.2 and below. The missing authorization check is tied to editor-facing plugin functionality, meaning the plugin must be installed and active. No special server configuration or non-default WordPress settings are required beyond having the plugin present. Exploitation is limited by the requirement for a valid, high-privilege authenticated session: unauthenticated visitors and low-privilege roles (Subscriber, Contributor) cannot trigger the flaw.

The CVSS base score of 4.9 (Medium) is consistent with the constrained attack surface: exploitation requires an authenticated session at high-privilege level (PR:H per the assigned vector), which meaningfully limits the exposed population to users who already hold elevated WordPress roles. EPSS data was not provided in the source intelligence, leaving probabilistic exploitation likelihood unquantifiable from available signals. KEV status is negative and no public exploit code has been identified, both of which reduce urgency relative to the raw integrity-impact rating. The integrity impact (I:H) is nonetheless real - unauthorized content modification in a media player plugin could allow an Editor to alter or inject player content across posts. For organizations hosting public-facing WordPress sites where Editor accounts are shared or loosely managed, the practical risk rises above what the score alone suggests; even a mid-sized municipal IT team in sopot-scale environments running multi-editor WordPress deployments should treat Editor-role access hygiene as a relevant compensating control. The absence of confidentiality and availability impact (C:N/A:N) confirms this is not a data-breach or service-disruption vector. Overall: moderate priority, elevated slightly by the integrity-only but High-rated impact class.

An attacker who has obtained WordPress Editor-level credentials - through phishing, credential stuffing, or insider access - authenticates to the WordPress admin panel and sends crafted requests to the FluentPlayer Pro editor endpoints that lack proper authorization checks. Because the plugin does not verify that the authenticated user holds sufficient privileges for the requested action, the Editor is permitted to modify plugin-controlled media content or configuration in ways normally restricted to Administrators. No public exploit code exists at time of analysis, so this scenario currently requires manual crafting of requests.