PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45442 Brainstorm Force CVE debrief

A Missing Authorization vulnerability in the Presto Player WordPress plugin (versions through 4.1.3) allows authenticated attackers with low privileges to exploit incorrectly configured access control security levels. The vulnerability, classified as CWE-862, was disclosed on May 19, 2026 and carries a CVSS 3.1 score of 4.3 (Medium severity). The issue stems from broken access control mechanisms that fail to properly restrict functionality to authorized users. Brainstorm Force is identified as the vendor behind the Presto Player plugin. The vulnerability status is currently marked as 'Deferred' in the National Vulnerability Database. No known exploitation in ransomware campaigns has been documented, and the vulnerability has not been added to CISA's Known Exploited Vulnerabilities catalog.

Vendor
Brainstorm Force
Product
Presto Player
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-19
Original CVE updated
2026-05-19
Advisory published
2026-05-19
Advisory updated
2026-05-19

Who should care

WordPress site administrators using Presto Player plugin versions 4.1.3 or earlier; security teams managing WordPress content management system deployments; developers responsible for plugin update management and access control policy enforcement

Technical summary

The Presto Player plugin for WordPress contains a Missing Authorization vulnerability (CWE-862) in versions 4.1.3 and earlier. The flaw allows authenticated users with low privileges to bypass intended access controls due to incorrectly configured security levels. The vulnerability has a CVSS 3.1 base score of 4.3 (Medium), with a vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, indicating network accessibility, low attack complexity, low privilege requirements, no user interaction needed, and limited confidentiality impact with no integrity or availability impact. The attack surface is exposed through network-accessible WordPress installations running the vulnerable plugin versions.

Defensive priority

medium

Recommended defensive actions

  • Update Presto Player to a version newer than 4.1.3 as soon as a patched release becomes available
  • Review WordPress user roles and permissions to enforce principle of least privilege
  • Monitor plugin changelog for security fixes addressing CVE-2026-45442
  • Consider implementing additional access control layers at the web application firewall level for WordPress administrative functions
  • Audit existing Presto Player configurations for unauthorized access patterns

Evidence notes

Vulnerability identified through Patchstack security research. CVSS vector confirms network attack vector with low attack complexity, requiring low privileges but no user interaction. Affected versions explicitly stated as through 4.1.3.

Official resources

2026-05-19