CVE-2026-66685 in Featured Video Plus Plugin
Summary
by MITRE • 08/06/2026
Unauthenticated Sensitive Data Exposure in Featured Video Plus <= 2.3.3 versions.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
The vulnerability identified as unauthenticated sensitive data exposure in Featured Video Plus plugin versions up to 2.3.3 represents a critical security weakness that allows unauthorized users to access protected content without proper authentication mechanisms. This flaw exists within the WordPress ecosystem where the plugin fails to implement adequate access controls for video content that should remain restricted to authenticated users only.
The technical implementation of this vulnerability stems from inadequate input validation and access control checks within the plugin's video retrieval functions. When users attempt to access featured videos through the plugin's API endpoints or direct URL access patterns, the system does not properly verify whether the requesting user possesses valid authentication credentials or appropriate authorization levels. This failure creates a pathway for attackers to bypass normal security boundaries and obtain access to premium or restricted video content that should only be available to registered users or specific user roles.
From an operational impact perspective, this vulnerability exposes organizations to significant risks including intellectual property theft, unauthorized content distribution, and potential revenue loss from premium video subscriptions. The exposure extends beyond simple data leakage to include potential exploitation for malicious activities such as content scraping, unauthorized redistribution, or use in phishing campaigns targeting users who might be tricked into accessing compromised video content.
The vulnerability aligns with CWE-200, which specifically addresses improper exposure of sensitive information, and demonstrates characteristics consistent with ATT&CK technique T1213.002 related to data from information repositories. Attackers can leverage this weakness through automated scanning tools or manual exploitation techniques to enumerate accessible video content and potentially discover additional vulnerabilities within the same system. The impact is particularly severe in environments where the plugin manages copyrighted material, proprietary training videos, or content requiring specific user permissions.
Organizations should implement immediate mitigations including updating to patched versions of the Featured Video Plus plugin, implementing proper access controls at the web server level, and conducting comprehensive security audits of all installed WordPress plugins. Additional protective measures include restricting API endpoint access through firewall rules, implementing rate limiting mechanisms, and establishing monitoring protocols to detect unauthorized access attempts. The vulnerability also underscores the importance of regular security assessments and maintaining up-to-date software versions to prevent exploitation of known security weaknesses in third-party components.