CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in bPlugins LLC Flash & HTML5 Video allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flash & HTML5 Video: from n/a through 2.5.30.
Explanation of Vulnerability in Simple Terms
The Flash & HTML5 Video plugin for WordPress does not properly check user permissions before allowing certain actions. A logged-in user with low privileges can modify content or settings they should not have access to. The vulnerability affects versions up to 2.5.30. Update to a version newer than 2.5.30 to resolve this issue.
What an attacker can do
A low-privilege logged-in user can modify plugin settings or content without proper authorization.
Potential impact on your site
Unauthorized users may alter video settings, metadata, or plugin configuration affecting site content.
Conditions required to exploit
Attacker must have a low-privilege WordPress account (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
