Description

Editor Broken Access Control in FluentPlayer Pro <= 1.3.2 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-08-27T10:16:39.043Z",
  "pubdate": "2026-08-27T10:16:39.043Z",
  "executiveSummary": "FluentPlayer Pro versions 1.3.2 and earlier are susceptible to a Broken Access Control vulnerability.\nThe vulnerability allows unauthorized users to perform actions within the editor interface that should be restricted to authenticated administrators.\nThis flaw stems from inadequate authorization checks on sensitive backend functions, enabling attackers to potentially modify plugin configurations or access restricted editor features without proper privileges.\nThe risk implication is significant as it compromises the integrity of the plugin and the underlying WordPress installation.\nAn unauthenticated or low-privileged attacker could exploit this vulnerability by directly invoking restricted API endpoints or action hooks.\nSuccessful exploitation requires the attacker to have network access to the target site, but does not necessitate elevated privileges on the WordPress platform.\nThe impact includes potential unauthorized site administration, data modification, or unauthorized execution of plugin-related tasks, leading to a complete compromise of the plugin's functionality.",
  "technicalDetails": "The vulnerability exists in FluentPlayer Pro <= 1.3.2 due to a failure to implement robust server-side authorization checks on the editor-related functionality.\nThe root cause is an insecure implementation of access control mechanisms within the plugin's controller or handling functions responsible for editor operations.\nSpecifically, the plugin fails to verify the current user's role or capabilities before executing functions that modify or manipulate editor data, assuming that the presence of a request to these endpoints implies authorization.\nAn attacker can exploit this by crafting malicious HTTP requests targeting the vulnerable endpoints, bypassing the UI-level restrictions that normally hide these functions from unauthorized users.\nThe attack flow typically involves identifying the specific action hook or URL path used by the editor interface to perform sensitive operations, such as saving player settings or modifying content structures.\nSince the backend code does not validate the user's session privileges, it processes the unauthorized requests and executes the associated logic with the permission level of the backend process, which is generally high.\nThis allows an attacker to interact with the plugin's core functions, potentially leading to unauthorized data manipulation or administrative configuration changes.\nThe scope of the exploitation is not limited to mere information disclosure; it allows for functional manipulation, meaning an attacker can affect the behavior of the player plugin across the site.\nPost-exploitation impact includes the ability to alter plugin-managed content, potential redirection of resources, or the unauthorized application of settings that may inadvertently weaken the security posture of the WordPress environment.\nThe vulnerability is reachable over the network and requires no special administrative privileges, making it a severe flaw for sites utilizing FluentPlayer Pro in its default, vulnerable configuration."
}