The YouTube Video Gallery by YouTube Showcase – Video Gallery Plugin for WordPress suffers from a missing capability check in the emd_form_builder_lite_submit_form function. This authorization bypass vulnerability (CWE-862) enables unauthenticated attackers to create arbitrary posts or pages within affected versions up to 3.3.6. The vulnerability has a CVSS 3.1 base score of 5.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to integrity. No known exploits in the wild or official patches have been reported as of the publication date.

An unauthenticated attacker can exploit this vulnerability to create arbitrary posts or pages on a WordPress site using the affected plugin. This unauthorized modification of data impacts the integrity of the site content but does not affect confidentiality or availability. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, site administrators should consider disabling or removing the affected plugin to prevent exploitation. Monitor official vendor channels for updates and apply patches promptly once available.