The vulnerability is a missing authorization flaw in the FWDesign Ultimate Video Player plugin that permits exploitation of incorrectly configured access control security levels. This means privileged plugin functions may be accessed without the proper authorization checks, potentially allowing an attacker to interact with the plugin beyond what their role should permit.

WordPress sites running the FWDesign Ultimate Video Player plugin version 10.1 or earlier are impacted. The flaw is present wherever the vulnerable plugin is installed, regardless of other WordPress components or themes.

The CVSS score of 5.3 indicates moderate severity. The EPSS score of less than 1 % suggests a very low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is web-based interaction with the plugin’s administrative interface; however, the CVE description does not provide explicit details of prerequisites or exposure terms.