The Presto Player plugin contains a missing authorization check that allows an attacker to bypass access controls and gain unauthorized use of privileged plugin features. This flaw is a classic broken access control, identified by CWE‑862, and permits exploitation of incorrectly configured security levels to view or manipulate content meant to be restricted.

Affected are installations of the Brainstorm Force Presto Player plugin for WordPress version 4.1.3 and earlier. Any WordPress site that has not upgraded past v4.1.3 is therefore susceptible.

The CVSS score of 4.3 places the vulnerability in the low‑moderate severity range. EPSS is not available, so the likelihood of exploitation is unclear, but the flaw was not listed in CISA’s KEV catalog. Since access control bypass can be achieved through the plugin’s web interface, an attacker with network access to the site could exploit the weakness if privilege checks are missing. The risk is moderate because successful exploitation can expose or alter protected content but does not grant arbitrary code execution.