Executive brief
YT Player is a WordPress plugin used to embed and manage YouTube videos on websites. A security flaw in versions 2.0.9 and earlier allows unauthorized individuals to perform actions that should be restricted to administrators. This could lead to unauthorized changes to plugin settings or content, potentially affecting the site's integrity.
Technical details
The YT Player plugin for WordPress (versions <= 2.0.9) suffers from a missing authorization check (CWE-862), classified as broken access control. This vulnerability allows an unauthenticated remote attacker to execute functions or actions that should require higher privileges. The flaw likely stems from a lack of proper capability checks or nonce validation on specific plugin endpoints. An attacker can exploit this over the network without any user interaction. As of the advisory date, no official patch has been released.
Affected products
- bPlugins YT Player <= 2.0.9
Timeline
- 2025-10-24: disclosed: Vulnerability reported by Que Thanh Tuan
- 2026-07-23: advisory: CVE published and NVD record created