The Youtube Embed Plus plugin for WordPress contains a missing authorization flaw that allows attackers to reach plugin endpoints without proper privilege checks. Because access controls are not enforced as intended, an attacker who can send requests to the plugin may be able to use functions that should be restricted, potentially exposing or altering embedded media settings. This weakness is identified as Missing Authorization (CWE‑862).

WordPress installations that have the embedplus Youtube Embed Plus plugin version 14.2.4 or earlier are affected. Any site running these versions with the plugin enabled is vulnerable until the plugin is updated to a later release.

The CVSS base score of 4.3 indicates a moderate severity. The EPSS score is below 1 %, which suggests that exploitation in the wild is currently unlikely. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Based on the description, the attack vector is inferred to be web‑based, requiring an attacker to deliver requests to the plugin’s endpoints. Because no authentication is enforced, any user with network access to the site could potentially exploit the flaw, but the risk remains moderate compared to higher‑severity exploits.