EUVD-2026-66950
GHSA-p57r-h5pf-g5xv
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
WordPress Editor role is a lower-privilege account (PR:L), not administrative; integrity-only impact with no confidentiality or availability consequence.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
1DescriptionCVE.org
Editor Broken Access Control in FluentPlayer Pro <= 1.3.2 versions.
AnalysisAI
Broken access control in FluentPlayer Pro (WordPress plugin by WP Manage Ninja) version 1.3.2 and earlier allows authenticated high-privilege users - specifically those with Editor-level roles - to perform integrity-affecting actions that should be restricted to higher authorization tiers. The flaw stems from missing authorization checks (CWE-862) on editor-facing endpoints, enabling unauthorized content modification within the plugin. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress session with at least Editor-level role permissions on the target installation - this is not a guest or subscriber-level attack. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 4.9 (Medium) is consistent with the constrained attack surface: exploitation requires an authenticated session at high-privilege level (PR:H per the assigned vector), which meaningfully limits the exposed population to users who already hold elevated WordPress roles. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained WordPress Editor-level credentials - through phishing, credential stuffing, or insider access - authenticates to the WordPress admin panel and sends crafted requests to the FluentPlayer Pro editor endpoints that lack proper authorization checks. Because the plugin does not verify that the authenticated user holds sufficient privileges for the requested action, the Editor is permitted to modify plugin-controlled media content or configuration in ways normally restricted to Administrators. … |
| Remediation | Update FluentPlayer Pro to a version newer than 1.3.2 once a patched release is published by WP Manage Ninja - no exact fixed version number is confirmed in available data at time of analysis (patch available per vendor/Patchstack advisory; verified release version not independently confirmed). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today