CVE-2026-85007

YT Player < 2.1.4 - Contributor+ Missing Authorization via ytp_ajax

low · 3.8

Fix listed

Published Oct 29, 2026, 06:00 UTC

Description

The Video Player for YouTube WordPress plugin before 2.1.4 does not perform a capability check on its player-preset AJAX handler, allowing users with the Contributor role and above to read the site-wide player-preset configuration, and in versions before 2.1.1 to modify and delete it as well.

Reported fixed versions

2.1.4

Official CVE record View source and advisories

Data from cve.now. Summaries, where shown, are licensed CC BY 4.0.