{"id":"CVE-2026-104678","title":"The CP Media Player  WordPress plugin before 1.3.4 does not perform a capability check on its settings-page handler, allowing users with only Contributor-level access to create, modify, duplicate and delete the site-wide media player con…","summary":"The CP Media Player  WordPress plugin before 1.3.4 does not perform a capability check on its settings-page handler, allowing users with only Contributor-level access to create, modify, duplicate and delete the site-wide media player con…","severity":"low","cvss":2.7,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","cwe":["CWE-284"],"product":"CP Media Player","affected":["cp_media_player < 1.3.4"],"published":"2026-10-07","updated":"2026-10-07","sourceUpdated":"2026-10-07T14:52:43.420","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104678","references":[{"url":"https://wpscan.com/vulnerability/d650ea4e-62f9-48a0-8cb3-e6761a95eeaa/","label":"contact@wpscan.com"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-07T09:54:27.424881Z"},"ingestedAt":"2026-10-07T08:20:03.940Z","epss":0.00168,"epssPercentile":0.05588,"slug":"CVE-2026-104678","body":"## Overview\n\nThe CP Media Player  WordPress plugin before 1.3.4 does not perform a capability check on its settings-page handler, allowing users with only Contributor-level access to create, modify, duplicate and delete the site-wide media player configurations and change a CP Media Player  WordPress plugin before 1.3.4 option that should require administrator access.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":15,"depthScoreParts":{"impact":14.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":217385,"id":"CVE-2026-104678","ts":1791368785851,"field":"cvss","old":null,"new":"2.7"},{"seq":217384,"id":"CVE-2026-104678","ts":1791368785851,"field":"severity","old":"none","new":"low"}]}