What is the CVSS score of EUVD-2026-39735?

EUVD-2026-39735 has a CVSS 3.1 base score of 5.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Flash & HTML5 Video EUVD-2026-39735

| CVE-2026-57323 MEDIUM

Missing Authorization (CWE-862)

2026-06-26 audit@patchstack.com

GHSA-3m22-fr69-7ch4

WordPress Authentication Bypass Wordpress Plugin

5.8

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

5.8 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

vuln.today AI

5.8 MEDIUM

Unauthenticated network exploitation with no complexity; scope change reflects cross-privilege data read; no integrity or availability impact applies.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 16:19 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in Flash & HTML5 Video <= 2.11.0 versions.

AnalysisAI

Unauthenticated broken access control in the Flash & HTML5 Video WordPress plugin (versions <= 2.11.0) allows remote unauthenticated attackers to bypass authorization checks and access restricted resources, crossing a privilege boundary (CVSS Scope Changed) with limited confidentiality impact. Reported by Patchstack and catalogued under EUVD-2026-39735, this is a CWE-862 (Missing Authorization) flaw requiring no credentials, no user interaction, and no special complexity to exploit. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Technical ContextAI

The Flash & HTML5 Video plugin is a WordPress media plugin providing embedded video playback via HTML5 with legacy Flash fallback. CWE-862 (Missing Authorization) indicates the plugin exposes one or more actions or REST/AJAX endpoints without validating whether the requesting user holds the appropriate WordPress capability or nonce. The CVSS Scope Changed (S:C) metric is notable: it signals that exploitation affects a security scope beyond the plugin itself - in WordPress context this typically means the attacker can read data owned by another role (e.g., draft posts, private metadata, or configuration values outside the plugin's own data store). The CVSS vector AV:N/AC:L/PR:N/UI:N reflects that the vulnerable endpoint is reachable over HTTP with no preconditions. No CPE string was provided; the affected product is identified solely as 'Flash & HTML5 Video <= 2.11.0' per EUVD-2026-39735.

RemediationAI

Update the Flash & HTML5 Video plugin to a version above 2.11.0 as soon as one is available. The Patchstack advisory at https://patchstack.com/database/wordpress/plugin/html5-video-player/vulnerability/wordpress-flash-html5-video-plugin-2-11-0-broken-access-control-vulnerability should be monitored for the confirmed patched release version, which was not independently confirmed in the available input data. If an update is not yet available, a compensating control is to deactivate the plugin entirely until a fix is released - this eliminates the attack surface with the trade-off of losing video functionality. Alternatively, use a Web Application Firewall (WAF) rule to block unauthenticated requests to the plugin's AJAX or REST endpoints (typically wp-admin/admin-ajax.php actions or /wp-json/ routes registered by the plugin); this reduces but does not eliminate risk and may interfere with legitimate anonymous video loading. WordPress site hardening (restricting direct file access, disabling XML-RPC if unused) provides defense-in-depth but does not address this specific authorization gap.