Unauthorized Modification of Data via Del_YtsingVID Function in Vimeo Plugin for WordPress

CVE-2024-11354

Summary

The Ultimate YouTube Video & Shorts Player with Vimeo plugin for WordPress exhibits a vulnerability that permits unauthorized data modification due to the absence of an essential capability check in the del_ytsingvid() function. This vulnerability is present in all versions up to and including 3.3. Authenticated attackers with Subscriber-level access and higher can exploit this issue to delete individual playlists, potentially leading to a significant compromise in data integrity and site functionality. Users are urged to implement security measures and update their plugins to mitigate potential risks.

References