CVE-2026-85007: YT Player < 2.1.4 - Contributor+ Missing Authorization via ytp_ajax
The Video Player for YouTube WordPress plugin before 2.1.4 does not perform a capability check on its player-preset AJAX handler, allowing users with the Contributor role and above to read the site-wide player-preset configuration, and in versions before 2.1.1 to modify and delete it as well.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Video Player for YouTube WordPress pluginto a version that resolves this vulnerability.Fixed in 2.1.4
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any authenticated WordPress user with the Contributor role or a higher role can access the affected player-preset AJAX handler.
What can an attacker do on affected versions?
Versions before 2.1.4 allow affected users to read the site-wide player-preset configuration. Versions before 2.1.1 also allow them to modify or delete that configuration.
Is updating to version 2.1.1 sufficient?
No. Version 2.1.1 addresses modification and deletion, but versions before 2.1.4 still expose the player-preset configuration to Contributors and higher roles. Update to 2.1.4 or later.