The Ultimate YouTube Video & Shorts Player With Vimeo WordPress plugin suffers from a missing capability check in the del_ytsingvid() function, classified as CWE-862 (Missing Authorization). This flaw permits authenticated attackers with low-level privileges (Subscriber and above) to delete single playlists, leading to unauthorized modification of data. The vulnerability has a CVSS 3.1 base score of 4.3 (medium severity), indicating low complexity and no user interaction required for exploitation. No patch or vendor advisory has been provided to confirm remediation status.

An attacker with at least Subscriber-level access can delete individual playlists within the plugin, resulting in unauthorized data modification. There is no direct confidentiality or availability impact reported. The integrity of playlist data is compromised, which could disrupt content management for affected WordPress sites.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Subscriber-level access to trusted users only to limit potential exploitation. Monitor plugin updates from the vendor for any official patches or temporary fixes.