The WP Video Playlist plugin for WordPress, developed by Sandeep Kumar, contains a missing authorization vulnerability (CVE-2025-31581) in versions up to 1.1.2. This vulnerability arises from improperly configured access control mechanisms, allowing unauthenticated attackers to perform actions that should require authorization. The CVSS 3.1 base score is 6.5 (medium), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and limited confidentiality and integrity impacts. No patch or vendor advisory is currently available, and no exploits have been observed in the wild.

Exploitation of this vulnerability could allow an unauthenticated attacker to access or modify data that should be protected by authorization controls, potentially leading to limited confidentiality and integrity breaches. There is no impact on availability. The medium CVSS score reflects these limited but non-negligible impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the plugin or disabling it if possible to reduce exposure. Monitor official channels for updates from the vendor or security advisories.