# CVE-2026-57323: bPlugins Flash & HTML5 Video broken access control

Source: https://junglewise.ai/threats/cve-2026-57323-bplugins-flash-html5-video-broken-access-control  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-26. Updated: 2026-06-26  
License: CC BY 4.0 with a link back

CVE-2026-57323 · Severity: medium · CVSS 5.8 · Published 2026-06-26

The Flash & HTML5 Video plugin for WordPress, which allows site owners to embed video players, contains a security flaw that permits unauthorized access. An unauthenticated attacker could exploit this to perform actions or access information that should be restricted to administrators. This could lead to unauthorized changes to video content or exposure of internal site configurations.

Vendors: [bPlugins](https://junglewise.ai/threats/vendors/bplugins).

## Quick answers

**Is CVE-2026-57323 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57323 being exploited in the wild.

**How severe is CVE-2026-57323?** Medium severity, with a CVSS score of 5.8, published 26 June 2026.

**Which products and versions are affected?** bPlugins Flash & HTML5 Video <= 2.11.0.

**Is there a fix for CVE-2026-57323?** A patch was published on 2026-06-26: Fixed in version 2.11.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57323 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-57323?** Check whether you run bPlugins Flash & HTML5 Video Player. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A broken access control vulnerability exists in the bPlugins Flash & HTML5 Video plugin for WordPress due to missing authorization checks (CWE-862) in certain functions. An unauthenticated remote attacker can exploit this flaw to execute actions that should require higher privileges. The vulnerability is present in versions up to 2.11.0 and was addressed in version 2.11.1. The CVSS 3.1 vector indicates a network-based attack with low complexity and no user interaction required, resulting in a limited impact on confidentiality.

## Affected products

- bPlugins Flash & HTML5 Video <= 2.11.0

## Timeline

- 2026-01-26: disclosed: Reported by Nabil Irawan
- 2026-06-26: advisory: Published by Patchstack and NVD
- 2026-06-26: patched: Fixed in version 2.11.1

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/html5-video-player/vulnerability/wordpress-flash-html5-video-plugin-2-11-0-broken-access-control-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/html5-video-player/vulnerability/wordpress-flash-html5-video-plugin-2-11-0-broken-access-control-vulnerability?_s_id=cve)