The Video Player for YouTube WordPress plugin contains a flaw in its AJAX handler, failing to verify the user’s capability. Users assigned the Contributor role or higher can fetch the entire site‑wide player‑preset configuration, and in older releases (before 2.1.1) may also alter or delete that configuration. This enables an attacker who can log in as a contributor to inspect or change plugin settings without proper approval, potentially disrupting playback behavior or enabling malicious scripts embedded in the configuration.

WordPress sites running the Video Player for YouTube plugin versions older than 2.1.4 are affected. Versions earlier than 2.1.1 expose even greater risk by allowing configuration modification and deletion. Any WordPress installation that has this plugin installed and accepts contributors or higher roles is at risk; users should verify their plugin version and disable or remove the plugin if an upgrade is not possible.

The vulnerability is exploitable through the public AJAX endpoint exposed by the plugin, but an attacker must be authenticated as a user with the Contributor role or higher. This limitation reduces the attack surface to authenticated users, yet the lack of a capability check means that any such user gains unintended read and write access to plugin settings. Because EPSS data is not available and the issue is not listed in the CISA KEV catalog, no public exploit data is currently known; however, the potential impact on configuration integrity and site behavior warrants prompt remediation. The CVSS score is 3.8; the flaw satisfies CWE-284: Improper Access Control.