The vulnerability in the WordPress Flash & HTML5 Video plugin, in versions 2.11.0 and earlier, allows a user without authentication to bypass access controls and perform actions that should be restricted to privileged users. Because the flaw is rooted in improper authorization checks, an attacker can potentially access, modify or delete video content, or insert malicious media without permission. The weakness maps to CWE‑862, indicating that the plugin fails to correctly enforce resource ownership or privilege levels.

The affected product is the bPlugins Flash & HTML5 Video plugin for WordPress, any WordPress installation running plugin version 2.11.0 or lower. No additional vendor or system details are provided beyond the plugin itself.

The CVSS score of 5.8 reflects the moderate severity of this access-control flaw. Exploitation is trivial in that no payload or advanced exploitation steps are required, only a recognized request to the plugin’s endpoints. However, there is no EPSS score available to gauge current exploitation pressure, and the vulnerability is not included in the CISA KEV catalog. The likely attack vector is over the network against a public or internal WordPress site that has the vulnerable plugin installed.