WordPress YouTube Embed Plus Plugin Broken Access Control Vulnerability

A missing authorization vulnerability has been identified in the YouTube Embed Plus WordPress plugin, specifically in versions through 14.2.4. This vulnerability allows unprivileged users to perform actions that require higher privileges, due to incorrectly configured access control.

Impact

Exploitation of this vulnerability could lead to unauthorized users gaining access to functions or features that require higher privileges, potentially allowing them to perform actions or make changes that they should not be able to.

Remediation

Users of the YouTube Embed Plus WordPress plugin should update to version 14.2.5 or later to address this vulnerability. Patchstack users can enable auto-update for vulnerable plugins.