CVE-2026-39485

MediumCVSS 4.3

Published: 08/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

10th percentile - higher than 10% of all known CVEs

Summary

The Youtube Embed Plus plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 14.2.4.

Risk Assessment

An attacker can gain unauthorized access to plugin settings, potentially leading to content modification or data theft.

Recommendation

Update the Youtube Embed Plus plugin to the latest version and verify access control configurations.

Original NVD description (English source)

Missing Authorization vulnerability in embedplus Youtube Embed Plus youtube-embed-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Youtube Embed Plus: from n/a through <= 14.2.4.