CVE-2026-45442: Presto Player Auth Bypass Vulnerability

CVE-2026-45442 Overview

CVE-2026-45442 is a Missing Authorization vulnerability [CWE-862] in the Brainstorm Force Presto Player plugin for WordPress. The flaw stems from incorrectly configured access control security levels, allowing authenticated users with low privileges to interact with functionality that should be restricted. The issue affects all Presto Player versions up to and including 4.1.3.

Attackers can exploit this vulnerability over the network without user interaction. Exploitation requires low-privilege authentication and yields a limited confidentiality impact, with no direct integrity or availability impact.

Critical Impact
Authenticated low-privilege users can bypass access control checks in Presto Player to access functionality that should be restricted, leading to unauthorized disclosure of plugin-managed data.

Affected Products

Brainstorm Force Presto Player (WordPress plugin)
All versions up to and including 4.1.3
WordPress sites running vulnerable Presto Player installations

Discovery Timeline

2026-05-19 - CVE-2026-45442 published to NVD
2026-05-19 - Last updated in NVD database

Technical Details for CVE-2026-45442

Vulnerability Analysis

The Presto Player plugin exposes functionality protected by access control checks that are incorrectly configured. The plugin fails to verify that the requesting user holds the appropriate capability or role before granting access to certain operations. This Broken Access Control flaw maps to [CWE-862] Missing Authorization.

The vulnerability is reachable over the network with low attack complexity. An attacker needs an authenticated session with low privileges, such as a subscriber-level WordPress account, to send the request that triggers the unauthorized action. No user interaction is required to exploit the flaw.

Impact is limited to confidentiality. Successful exploitation discloses information managed by the plugin but does not allow modification of data or disruption of service through this issue alone.

Root Cause

The root cause is an incorrectly configured access control security level on one or more Presto Player endpoints. The plugin code does not consistently call WordPress capability checks such as current_user_can() or equivalent authorization logic before performing privileged actions. Any authenticated user can therefore invoke the affected handler.

Attack Vector

An attacker authenticates to the target WordPress site using any low-privilege account. The attacker then issues a crafted HTTP request to the vulnerable Presto Player endpoint. Because the endpoint lacks proper authorization enforcement, the server processes the request and returns data that should be restricted to higher-privileged roles.

The vulnerability mechanism is described in the Patchstack Presto Player Vulnerability advisory. No public proof-of-concept exploit is available at the time of publication.

Detection Methods for CVE-2026-45442

Indicators of Compromise

Unexpected requests to Presto Player REST API or admin-ajax endpoints from accounts with subscriber or contributor roles.
WordPress access logs showing low-privilege user IDs accessing plugin functionality typically used by editors or administrators.
Anomalous data export or read patterns originating from authenticated but low-privileged sessions.

Detection Strategies

Audit WordPress access logs for HTTP requests targeting Presto Player endpoints correlated with non-administrative user roles.
Deploy a Web Application Firewall (WAF) rule that inspects requests to plugin endpoints and validates the requester's role against expected access policy.
Review WordPress user activity logging plugins for unexpected actions performed by subscriber-tier accounts.

Monitoring Recommendations

Monitor the installed version of Presto Player across managed WordPress sites and flag any instance at version 4.1.3 or earlier.
Track creation of new low-privilege accounts followed by immediate access to plugin endpoints.
Forward WordPress and web server logs to a central data lake for correlation against role-based access expectations.

How to Mitigate CVE-2026-45442

Immediate Actions Required

Update Presto Player to a version newer than 4.1.3 once a vendor-supplied patch is available.
Inventory all WordPress sites in the environment and identify those running vulnerable Presto Player builds.
Restrict registration of low-privilege accounts on sites where open registration is not required.

Patch Information

Refer to the Patchstack Presto Player Vulnerability advisory for the latest patch status and fixed version information from Brainstorm Force. Apply the vendor-supplied update through the WordPress plugin manager once released.

Workarounds

Disable the Presto Player plugin on affected sites until a fixed version is installed.
Use a WAF or access control rule to block unauthenticated and low-privileged requests to Presto Player endpoints.
Temporarily limit the WordPress default role for new registrations and audit existing low-privilege accounts.

bash

# Configuration example: disable Presto Player via WP-CLI until patched
wp plugin deactivate presto-player --all
wp plugin status presto-player