Description
The VidoRev Extensions plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'vidorev_import_single_video' AJAX action in all versions up to, and including, 2.9.9.9.9.9.5. This makes it possible for unauthenticated attackers to import arbitrary youtube videos.
Published: 2025-03-14
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Access
Action: Patch
AI Analysis

Impact

The vulnerability in VidoRev Extensions up to 2.9.9.9.9.9.5 stems from a missing capability check on the 'vidorev_import_single_video' AJAX action, permitting unauthenticated users to import arbitrary YouTube videos. This unauthorized data import can expose a site to unwanted or malicious content, exemplifying a classic missing authorization flaw (CWE-862).

Affected Systems

The flaw affects the WordPress plugin VidoRev Extensions distributed by beeteam368. All releases with versions up to and including 2.9.9.9.9.9.5 are susceptible. Sites employing this plugin and exposing the AJAX endpoint should evaluate their exposure.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate risk; the EPSS score is less than 1 %, reflecting a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely through the publicly reachable '/wp-admin/admin-ajax.php' endpoint; an attacker can simply send an unauthenticated HTTP request to trigger the import action, requiring no privileged credentials or complex setup.

Generated by OpenCVE AI on April 21, 2026 at 21:56 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade VidoRev Extensions to the latest stable release that implements a proper capability check for the vidorev_import_single_video action.
  • If an updated version is not available, disable the single-video import feature or remove the plugin entirely until a fix is released.
  • Restrict the AJAX endpoint by configuring a web application firewall rule that blocks unauthenticated POST requests targeting the vidorev_import_single_video action.

Generated by OpenCVE AI on April 21, 2026 at 21:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-6426 The VidoRev Extensions plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'vidorev_import_single_video' AJAX action in all versions up to, and including, 2.9.9.9.9.9.5. This makes it possible for unauthenticated attackers to import arbitrary youtube videos.
History

Mon, 14 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00076}

 epss

{'score': 0.00106}

Fri, 14 Mar 2025 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 14 Mar 2025 04:45:00 +0000

Type Values Removed Values Added
Description The VidoRev Extensions plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'vidorev_import_single_video' AJAX action in all versions up to, and including, 2.9.9.9.9.9.5. This makes it possible for unauthenticated attackers to import arbitrary youtube videos.
Title VidoRev Extensions <= 2.9.9.9.9.9.5 - Missing Authorization to Unauthenticated Youtube Video Import
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T17:30:40.394Z

Reserved: 2025-01-31T20:04:06.880Z

Link: CVE-2025-0955

cve-icon Vulnrichment

Updated: 2025-03-14T13:46:24.848Z

cve-icon NVD

Status : Deferred

Published: 2025-03-14T05:15:41.760

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-0955

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-21T22:00:26Z

Weaknesses