Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-11355: Ultimate YouTube Video & Shorts Player With Vimeo plugin for WordPress allows unauthorized access to settings

CVE-2024-11355 · published 1 year ago

Summary

The Ultimate YouTube Video & Shorts Player With Vimeo plugin for WordPress has a security weakness that allows users with Subscriber-level access or higher to view sensitive settings for playlists without permission. This means an attacker could potentially access and view confidential settings. To protect your site, update to a fixed version of the plugin or remove and reinstall it.

Original advisory text

The Ultimate YouTube Video & Shorts Player With Vimeo plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_setting() function in all versions up to, and including, 3.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view settings for playlists.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

4.3 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-862Missing Authorization

Timeline

Published22 Nov 2024

Updated30 Oct 2026

First seen7 Mar 2026

Sources

CVE-2024-11355 · NVD

Track software like this

Free during beta