Technical impact
MadrasThemes MAS Videos plugin versions up to 1.3.2 contains a missing authorization flaw that allows attackers to exploit incorrectly configured access control security levels. The vulnerability enables unauthorized users to bypass intended access restrictions, potentially accessing or manipulating the plugin’s data and functionality. This weakness is classified as CWE-862, which denotes a missing authorization flaw.
Affected Systems
The affected systems are installations of the MAS Videos WordPress plugin developed by MadrasThemes, specifically any version from the earliest available through 1.3.2. No specific minor versions are listed beyond the upper bound.
Risk and Exploitability
The CVSS score of 5.3 indicates a moderate severity rating. However, the EPSS score of less than 1 percent suggests that exploitation is currently unlikely. The vulnerability is not present in the CISA KEV catalog. The attack vector is not explicitly defined in the report; based on the nature of the flaw (missing authorization in a WordPress plugin), the likely vector is remote via the web interface, but this is inferred and not directly cited.
