The vulnerability CVE-2025-31782 affects the pupunzi mb.YTPlayer plugin (versions <= 3.3.8) and is characterized by missing authorization checks. This results in incorrect access control security levels, potentially allowing unauthorized users with low privileges to perform actions that should require higher authorization. The CVSS score is 5.4 (medium), with network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on integrity and availability but not confidentiality. No known exploits are reported in the wild, and no patch or vendor advisory is currently available.

Exploitation of this vulnerability could allow an attacker with low privileges to perform unauthorized actions that may alter data or disrupt service availability. Confidentiality is not affected. The medium CVSS score reflects moderate risk due to the potential integrity and availability impacts combined with the ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and tighten access control configurations for the mb.YTPlayer plugin to limit unauthorized access. Monitor for updates from the vendor or security advisories for any released patches or mitigations.