The vulnerable Target Video Easy Publish plugin for WordPress contains a missing authorization flaw that allows an attacker to execute arbitrary code when interacting with the plugin’s shortcode functionality. The flaw stems from inadequate checks for user permissions before processing shortcode requests, enabling attackers to inject malicious code into the site’s content. This weakness is identified as CWE-862: Missing Authorization.

WordPress sites that have the Target Video Easy Publish plugin from Nebojsa installed and running any version equal to or older than 3.8.9 are affected. No additional version details are provided beyond the stated upper bound.

The vulnerability carries a CVSS score of 5.4, indicating moderate severity, and an EPSS score of less than 1%, suggesting low probability of exploitation. It is not listed in the CISA KEV catalog. Likely attack vectors involve attackers who can add or edit content on the site, exploiting the missing authorization check during shortcode processing. The risk level is moderate but mitigatable with appropriate patching or configuration changes.