---
id: CVE-2026-85007
title: YT Player < 2.1.4 - Contributor+ Missing Authorization via ytp_ajax
summary: >-
  The Video Player for YouTube  WordPress plugin before 2.1.4 does not perform a
  capability check on its player-preset AJAX handler, allowing users with the
  Contributor role and above to read the site-wide player-preset configuration,
  and …
severity: low
cvss: 3.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N'
cvssSource: adp
cwe:
  - CWE-284
product: Video Player for YouTube
affected:
  - video_player_for_youtube < 2.1.4
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-29T10:46:12.610882Z'
published: '2026-10-29'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T10:46:16.022Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-85007'
references:
  - url: 'https://wpscan.com/vulnerability/dd4db01b-8cb9-42d7-8c0b-9afb6e83dc88/'
tags:
  - cve.org
epss: 0.00152
epssPercentile: 0.04419
ingestedAt: '2026-11-01T17:57:46.215Z'
---

## Overview

The Video Player for YouTube  WordPress plugin before 2.1.4 does not perform a capability check on its player-preset AJAX handler, allowing users with the Contributor role and above to read the site-wide player-preset configuration, and in versions before 2.1.1 to modify and delete it as well.

## Affected

- `video_player_for_youtube < 2.1.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.