# CVE-2026-45442: Brainstorm Force Presto Player missing authorization in access control

Source: https://junglewise.ai/threats/cve-2026-45442-brainstorm-force-presto-player-missing-authorization-in-access  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-19. Updated: 2026-05-19  
License: CC BY 4.0 with a link back

CVE-2026-45442 · Severity: medium · CVSS 4.3 · Published 2026-05-19

Presto Player is a video player plugin for WordPress used to manage and display video content. A security flaw in the plugin's access control settings allows users with low-level accounts to bypass intended restrictions. This could lead to unauthorized access to video content or settings that should be restricted to administrators.

Technologies: [Brainstorm Force Presto Player](https://junglewise.ai/threats/technologies/presto-player). Vendors: [Brainstorm Force](https://junglewise.ai/threats/vendors/brainstorm-force).

## Quick answers

**Is CVE-2026-45442 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45442 being exploited in the wild.

**How severe is CVE-2026-45442?** Medium severity, with a CVSS score of 4.3, published 19 May 2026.

**Which products and versions are affected?** Brainstorm Force Presto Player up to 4.1.3.

**Is there a fix for CVE-2026-45442?** A patch was published on 2026-05-19: Fixed in version 4.1.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45442 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-45442?** Check whether you run Brainstorm Force Presto Player at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A missing authorization vulnerability (CWE-862) exists in the Brainstorm Force Presto Player plugin for WordPress. The flaw resides in the handling of access control security levels, where the application fails to properly validate the permissions of a user before granting access to specific functionality or data. An attacker with low-privileged access (subscriber or contributor level) can exploit this to bypass intended restrictions. The issue affects all versions up to and including 4.1.3 and is resolved in version 4.1.4.

## Affected products

- Brainstorm Force Presto Player up to 4.1.3

## Timeline

- 2026-02-14: disclosed: Reported by Bao - BlueRock
- 2026-05-19: patched: Fixed in version 4.1.4
- 2026-05-19: advisory: Published by Patchstack and NVD

## References

- [https://patchstack.com/database/wordpress/plugin/presto-player/vulnerability/wordpress-presto-player-plugin-4-1-3-broken-access-control-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/presto-player/vulnerability/wordpress-presto-player-plugin-4-1-3-broken-access-control-vulnerability?_s_id=cve)

## Related threats

- [Brainstorm Force Presto Player stored cross-site scripting](https://junglewise.ai/threats/cve-2026-109893-improper-neutralization-of-input-during-web-page-generation)
- [Brainstorm Force Presto Player stored cross-site scripting](https://junglewise.ai/threats/cve-2026-102914-improper-neutralization-of-input-during-web-page-generation)