CVE-2026-7544: Mux Video Uploader Info Disclosure Flaw

CVE-2026-7544 Overview

CVE-2026-7544 is a sensitive information exposure vulnerability affecting the Mux Video Uploader plugin for WordPress in all versions up to and including 1.1.4. The flaw resides in the muxvideo_enqueue_settings_script function, which exposes Mux API credentials to any authenticated user. Attackers holding subscriber-level access or higher can retrieve these credentials directly from the front-end script context. The weakness is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Authenticated attackers with subscriber-level access can extract Mux API credentials, enabling unauthorized access to the site owner's Mux video account and potential abuse of paid video services.

Affected Products

Mux Video Uploader plugin for WordPress (2coders-integration-mux-video)
All plugin versions up to and including 1.1.4
WordPress sites permitting subscriber-level or higher user registration

Discovery Timeline

2026-07-11 - CVE-2026-7544 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-7544

Vulnerability Analysis

The vulnerability originates in the muxvideo_enqueue_settings_script function within includes/functions.php of the Mux Video Uploader plugin. This function enqueues a JavaScript settings object into WordPress pages using wp_localize_script or an equivalent mechanism. The exposed script bundle contains configuration values including Mux API tokens.

The function executes for any authenticated session without verifying user capability or role. WordPress renders the enqueued script on administrative or front-end pages accessible to low-privilege users. A subscriber can therefore view the page source and harvest the credentials embedded in the JavaScript payload.

Once extracted, Mux API credentials permit the attacker to interact with the victim's Mux account outside the WordPress boundary. This includes uploading, deleting, or manipulating video assets and consuming paid streaming quota.

Root Cause

The root cause is missing capability checking before enqueuing sensitive configuration data. The plugin treats API credentials as client-side configuration values suitable for inline JavaScript exposure. WordPress security guidance requires such secrets to remain server-side and to be accessed only through capability-gated AJAX endpoints or REST routes protected by current_user_can() checks.

Attack Vector

Exploitation requires an authenticated account with subscriber-level access or higher. The attacker logs into the WordPress site, navigates to any page that triggers the vulnerable muxvideo_enqueue_settings_script handler, and inspects the rendered HTML source or DOM. The Mux API credentials appear as literal string values within the enqueued JavaScript object.

No user interaction beyond authentication is required, and the attack executes entirely over the network against the vulnerable WordPress installation. Sites that allow open user registration, common on membership and e-commerce platforms, present the broadest exposure.

Refer to the WordPress Plugin Function Code at line 668 and line 672 for the exact vulnerable code paths.

Detection Methods for CVE-2026-7544

Indicators of Compromise

Presence of Mux API tokens or environment identifiers in HTML source served to non-administrative users.
Unexpected outbound API calls to api.mux.com originating from IP addresses unrelated to the site administrator.
New or modified video assets in the Mux dashboard that do not correspond to legitimate site uploads.
Newly registered low-privilege WordPress accounts followed by anomalous page requests to plugin-loaded views.

Detection Strategies

Review page source served to authenticated subscribers and search for Mux credential patterns embedded in JavaScript.
Audit WordPress access logs for subscriber accounts requesting pages that trigger plugin script enqueuing.
Enable Mux account audit logging and correlate API activity against known administrator source IPs.
Scan installed plugin versions across WordPress fleets and flag 2coders-integration-mux-video at version 1.1.4 or earlier.

Monitoring Recommendations

Continuously monitor for anomalous authenticated session behavior on WordPress sites that permit open registration.
Alert on Mux API key usage originating outside expected administrative IP ranges or during off-hours.
Track new user registrations paired with rapid page enumeration as a precursor to credential harvesting.

How to Mitigate CVE-2026-7544

Immediate Actions Required

Update the Mux Video Uploader plugin to a version newer than 1.1.4 once the vendor publishes a patched release.
Rotate all Mux API credentials configured within the plugin, since prior tokens may already be compromised.
Restrict WordPress user registration where subscriber accounts are not required for business operations.
Review Mux account activity logs for unauthorized API calls or asset modifications since plugin installation.

Patch Information

The vendor patch is tracked in the WordPress Plugin Changeset 3543763. Additional analysis is available in the Wordfence Vulnerability Analysis. Administrators should verify the installed version reflects the changeset fix before considering the site remediated.

Workarounds

Deactivate the Mux Video Uploader plugin until a patched release is verified and installed.
Apply a web application firewall rule to block subscriber-level access to pages that enqueue plugin scripts containing credentials.
Revoke exposed Mux API tokens at the Mux dashboard and issue new tokens scoped to the minimum required permissions.

bash

# Configuration example
# Identify vulnerable plugin installations via WP-CLI
wp plugin list --name=2coders-integration-mux-video --fields=name,status,version

# Deactivate the plugin as a temporary workaround
wp plugin deactivate 2coders-integration-mux-video

# Restrict new user registrations until patch is applied
wp option update users_can_register 0