CVE-2024-11354

Summary

CVE-2024-11354 is a vulnerability affecting the Ultimate YouTube Video & Shorts Player With Vimeo plugin for WordPress. The issue lies in the lack of capability checks on the del_ytsingvid() function, which can be exploited by authenticated attackers with Subscriber-level access or higher. This vulnerability allows the deletion of single playlists, posing a risk to the integrity of the affected WordPress sites. Unpatched installations of the plugin, up to and including version 3.3, are susceptible to this issue.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.