EUVD-2026-94183
GHSA-r3hc-2fxj-7r5f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as Contributor-level user
-
ExploitSend request to unprotected settings handler
-
ImpactModify or delete site-wide media player configuration
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated WordPress account with at least Contributor-level privileges on a site running CP Media Player before 1.3.4; the plugin's settings-page handler lacks a capability check, so any such logged-in user can reach it over the network (AV:N) with no user interaction and no special configuration. Limiting factors: exploitation is impossible for unauthenticated/anonymous visitors, impact is confined to media player configuration integrity (no confidentiality or availability loss), and sites that do not grant Contributor accounts to untrusted users face minimal exposure. |
| Impact | This is a low-severity broken access control flaw (CWE-284), and every signal points to low real-world priority rather than an urgent threat. The input CVSS base score is 2.7, and even my own assessment only raises it to ~4.3 (Medium). The vulnerability requires an existing authenticated account (the description specifies Contributor-level access), so it cannot be triggered by anonymous internet attackers. No EPSS score and no CISA KEV listing were provided, so there is no evidence of widespread or active exploitation; the only exploitation signal is a publicly available WPScan proof-of-concept, which indicates exploitability but NOT active in-the-wild use - those are distinct signals. NOTE A CONFLICT: the supplied CVSS vector uses PR:H (high privilege), yet the description explicitly says only Contributor-level (a low-privilege WordPress role) access is needed; PR:H understates reachability and PR:L is the more defensible choice - verify role mapping with WPScan/vendor. Overall this is a genuine-but-minor privilege/configuration-integrity issue, not a high-priority emergency. |
| Exploit ScenarioDerived | An attacker who already holds (or obtains via self-registration/compromise) a low-privilege Contributor account on a WordPress site running CP Media Player before 1.3.4 sends a request directly to the plugin's settings-page handler, which performs no capability check. They then create, modify, duplicate or delete site-wide media player configurations and toggle an option that should be admin-only. A public WPScan proof-of-concept exists, lowering the skill needed, though a valid authenticated account is a prerequisite. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Missing capability checks in the CP Media Player WordPress plugin before 1.3.4 let any authenticated user holding Contributor-level access create, modify, duplicate, and delete the site-wide media player configurations, and change at least one plugin setting that should be administrator-only. Exploitation requires a logged-in WordPress account with Contributor privileges on a site running the vulnerable plugin, with no user interaction required; publicly available exploit code exists, and there is no indication of active exploitation. This is an integrity-only, low-severity broken access control issue - our independent assessment scores it CVSS 3.1 2.7 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) - and every signal points to low real-world priority rather than an urgent threat.
RemediationAI
Vendor-released patch: upgrade the CP Media Player WordPress plugin to version 1.3.4 or later, which restores the capability check on the settings-page handler; this is the only complete fix and should be applied through the WordPress plugin updater or by reinstalling the plugin from the vendor. If an immediate update is not possible, the most effective compensating control is to remove or downgrade Contributor and higher accounts that are not strictly trusted - this directly removes the prerequisite because exploitation is impossible for unauthenticated visitors - with the trade-off of disrupting legitimate editorial workflows, and it does not help sites that genuinely need Contributor users. Additional temporary measures include disabling open/self-service user registration or any role-assignment mechanism that grants Contributor by default, restricting access to wp-admin by IP allow-listing (which can inconvenience remote editors), or deactivating the plugin entirely until it can be patched (which removes the media player functionality from the site). Note that the public exploit code is available, so delaying the upgrade past the window in which Contributor accounts exist on vulnerable sites is not advisable. Vendor and researcher details, including confirmation of the fixed version, are at https://wpscan.com/vulnerability/d650ea4e-62f9-48a0-8cb3-e6761a95eeaa/.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic WordPress plugin capability-check omission in the CWE-284 (Improper Access Control) family. WordPress plugins register settings pages through admin_menu/add_submenu_page hooks and process their form submissions via admin-post.php or admin_init handlers; correct implementations gate those handlers behind current_user_can() checks such as manage_options. CP Media Player's settings-page handler performs no such check, so the authorization decision is effectively delegated to the WordPress role system alone, and any role above the intended threshold can reach the handler. Contributors normally hold only edit_posts/delete_posts and cannot manage site options, so this exposes functionality (site-wide player configuration and at least one admin-level option) that the plugin author intended to be administrator-restricted. The supplied CPE string, cpe:2.3:a:unknown:cp_media_player:*:*:*:*:*:*:*:*, tracks the plugin as cp_media_player with no vendor attribution and no version bounding, meaning the record covers all releases below the fixed 1.3.4. Note the vendor-supplied CVSS vector carries PR:H while our independent assessment uses PR:L, reflecting that Contributor accounts are legitimately authenticated users rather than high-privileged ones; the practical consequence of the discrepancy is a modest severity difference on an already low-scoring issue, not a change in exploitation preconditions. Impact is confined to configuration integrity - there is no loss of confidentiality or availability in either vector.
Know when Cp Media Player gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Contributor is a low-privilege authenticated role so PR:L (not the input's PR:H); network-reachable handler with no UI gives AV:N/AC:L/UI:N; only config integrity is affected, so C:N/I:L/A:N.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The CP Media Player WordPress plugin before 1.3.4 does not perform a capability check on its settings-page handler, allowing users with only Contributor-level access to create, modify, duplicate and delete the site-wide media player configurations and change a CP Media Player WordPress plugin before 1.3.4 option that should require administrator access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB