CVE-2026-104678

LowCVSS 2.7

Published: 07/10/2026(UTC)Updated: 07/10/2026(UTC)Translated: 07/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

6th percentile - higher than 6% of all known CVEs

Summary

The CP Media Player WordPress plugin before version 1.3.4 does not perform a capability check on its settings-page handler, allowing users with Contributor-level access to create, modify, duplicate, and delete site-wide media player configurations and change an option that should require administrator access.

Risk Assessment

Low-privileged users may take control over the player configuration, potentially leading to unauthorized changes and potential attacks.

Recommendation

Update the CP Media Player plugin to version 1.3.4 or later, which includes the fix.

Other vulnerabilities in CP Media Player

CVE-2026-78281High
Unauthenticated XSS vulnerability in CP Media Player versions up to 1.3.0. An attacker can inject malicious script that executes in the victim's browser.

Original NVD description (English source)

The CP Media Player WordPress plugin before 1.3.4 does not perform a capability check on its settings-page handler, allowing users with only Contributor-level access to create, modify, duplicate and delete the site-wide media player configurations and change a CP Media Player WordPress plugin before 1.3.4 option that should require administrator access.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS