Access Control Flaw in CP Media Player Plugin for WordPress
CVE-2026-104678

Currently unrated

Key Information:

Vendor

WordPress
Status
Cp Media Player
Vendor
CVE Published:
7 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-104678?

The CP Media Player plugin for WordPress, prior to version 1.3.4, suffers from an access control vulnerability. This issue arises because the plugin fails to implement proper capability checks on its settings-page handler. As a result, users with only Contributor-level permissions can create, modify, duplicate, and delete media player configurations that should strictly require administrator rights. This could lead to unauthorized changes and potential manipulation of the media player settings, raising significant security concerns for WordPress site administrators.

Affected Version(s)

CP Media Player 0 < 1.3.4

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-104678 - Proof of Concept

References

https://wpscan.com/vulnerability/d650ea4e-62f9-48a0-8cb3-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ryan Fabella
WPScan
.