The vulnerability is a missing authorization check that allows an attacker to modify the settings of the WP Video Playlist plugin. Without proper access control, a malicious user can change configuration values, potentially redirecting video links, altering display options, or exposing sensitive data. The primary consequence is privilege escalation within the WordPress site, granting the attacker unauthorized control over plugin behavior.

Sandeep Kumar’s WP Video Playlist plugin for WordPress. Versions from the first release through 1.1.2 are affected. Any WordPress installation that has the plugin installed, regardless of the site user base, may be susceptible if the plugin is present and the attacker has a way to reach its settings page.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score of <1% suggests that the likelihood of exploitation is low as of the latest data, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the flaw is exploitable remotely via the WordPress admin interface once a user can reach the plugin’s configuration page. Because it lacks an authentication requirement, an unauthenticated or low‑privilege user could potentially manipulate settings, making the attack vector likely remote through a web interface.