Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.7
CVE-2026-104678: CP Media Player lets contributors change site media settings
CVE-2026-104678 · published 12 days ago
Summary
The CP Media Player plugin for WordPress, versions before 1.3.4, allows users with only contributor rights to alter the global media player setup. This could let unintended users modify how media plays across the whole site. Update the plugin to version 1.3.4 or later and ensure only administrators have access to the plugin’s settings page.
What to do
- Update unknown cp media player to version 1.3.4 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | cp media player | < 1.3.4 |
Original advisory text
CP Media Player < 1.3.4 - Contributor+ Media Player Settings Update
The CP Media Player WordPress plugin before 1.3.4 does not perform a capability check on its settings-page handler, allowing users with only Contributor-level access to create, modify, duplicate and delete the site-wide media player configurations and change a CP Media Player WordPress plugin before 1.3.4 option that should require administrator access.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
2.7
Low
Type
CWE-284Improper Access Control
Timeline
Published7 Oct 2026
Updated14 Oct 2026
First seen7 Oct 2026
Track software like this
Free during beta