Access Control Vulnerability in Embed Plus for YouTube by WordPress
CVE-2026-39485

4.3MEDIUM

Key Information:

Vendor

WordPress
Status
Youtube Embed Plus
Vendor
CVE Published:
8 April 2026

What is CVE-2026-39485?

The Embed Plus for YouTube plugin for WordPress is prone to a security vulnerability due to missing authorization. This flaw allows attackers to exploit incorrectly configured access control settings, potentially leading to unauthorized access to sensitive features or data within the application. This issue impacts versions up to and including 14.2.4, necessitating urgent attention to configure access controls properly.

Affected Version(s)

Youtube Embed Plus 0 <= 14.2.4

References

https://patchstack.com/database/Wordpress/Plugin/youtube-...
vdb-entry

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Trương Hữu Phúc (truonghuuphuc) | Patchstack Bug Bounty Program
.