What is GHSA-r3hc-2fxj-7r5f?

GHSA-r3hc-2fxj-7r5f is a security advisory published by GitHub Security Advisories with Low severity. The CP Media Player WordPress plugin before 1.3.4 does not perform a capability check on its...

Which CVE IDs does GHSA-r3hc-2fxj-7r5f cover?

GHSA-r3hc-2fxj-7r5f covers the following CVE IDs: CVE-2026-104678. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-r3hc-2fxj-7r5f?

GHSA-r3hc-2fxj-7r5f has a CVSS v3 base score of 2.7, published by GitHub Security Advisories.

GHSA-r3hc-2fxj-7r5fLowCVSS 2.7

The CP Media Player WordPress plugin before 1.3.4 does not perform a capability check on its...

Vendor

GitHub Security Advisories

Published

October 7, 2026

Last Modified

October 7, 2026

🔗 CVE IDs covered (1)

CVE-2026-104678 →

📋 Description

The CP Media Player WordPress plugin before 1.3.4 does not perform a capability check on its settings-page handler, allowing users with only Contributor-level access to create, modify, duplicate and delete the site-wide media player configurations and change a CP Media Player WordPress plugin before 1.3.4 option that should require administrator access.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-104678
https://wpscan.com/vulnerability/d650ea4e-62f9-48a0-8cb3-e6761a95eeaa
https://github.com/advisories/GHSA-r3hc-2fxj-7r5f