CVE-2026-104678

The CP Media Player plugin for WordPress prior to version 1.3.4 has a vulnerability that permits users with only Contributor-level access to alter site-wide media player configurations, including creating, modifying, and deleting settings that should be restricted to administrators. This flaw could lead to unauthorized changes in media management, potentially affecting site functionality and security. WordPress site administrators and security teams should prioritize updating this plugin to mitigate the risk of unauthorized access and configuration changes.