YouTube Video Player CVE-2026-85007

Requires an authenticated WordPress account with the Contributor role or higher on the target site; the plugin's player-preset AJAX handler performs no capability check. In versions before 2.1.1 a Contributor+ user can read, modify, and delete the site-wide player-preset configuration; in 2.1.1 up to before 2.1.4 the same actor can only read it. Limiting factors: exploitation is impossible for fully unauthenticated visitors (an account at Contributor level must already exist, most relevant on multi-author/open-registration sites), and impact is confined to the plugin's player-preset configuration with no availability effect.

This is a low-priority, low-severity issue (CVSS 3.8) and the signals are consistent in pointing that way rather than conflicting. Attack vector is network (AV:N) with low complexity (AC:L) and no user interaction (UI:N), but it requires an authenticated account and the impact is partial: confidentiality and integrity are Low (C:L/I:L) with no availability impact (A:N), reflecting access only to the plugin's player-preset configuration. SSVC reinforces low urgency - Exploitation: none, Automatable: no, Technical Impact: partial - and the vuln.today decision label is 'monitor'. There is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active exploitation; the only exploit artifact is a WPScan reference, not verified working exploit code. One signal should be reconciled: the supplied CVSS vector states PR:H (high privileges), yet the description says the actor is a user with the Contributor role and above - Contributor is a low-privilege authenticated role, so PR:L is the more defensible choice and the vendor-supplied PR:H likely overstates the privilege barrier. Net assessment: a genuine broken-access-control bug worth patching on a normal cycle, but not an emergency.

A low-trust user who already holds a Contributor account on a multi-author WordPress site invokes the plugin's player-preset AJAX handler, which never checks their capabilities. On sites running a version before 2.1.1 the attacker can read, alter, or delete the site-wide player-preset configuration, affecting how the YouTube player renders for all visitors; on 2.1.1 through before 2.1.4 they can only read it. A WPScan PoC reference exists but is not verified as working exploit code.