Sensitive Information Exposure in Mux Video Uploader WordPress Plugin

Executive Summary

The Mux Video Uploader plugin for WordPress has a vulnerability in all versions up to and including 1.1.4. This vulnerability exists in the muxvideo_enqueue_settings_script function, which allows authenticated attackers with subscriber-level access or higher to extract sensitive information.

Specifically, attackers can obtain sensitive data such as Mux API credentials, which should normally be protected.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to sensitive information exposure, allowing attackers with relatively low privileges (subscriber-level access) to retrieve Mux API credentials.

With these credentials, attackers could potentially misuse the Mux API, leading to unauthorized access or manipulation of video content or related services.

The CVSS score of 4.3 indicates a medium severity impact, primarily due to confidentiality loss without affecting integrity or availability.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows authenticated attackers with subscriber-level access to extract sensitive data, including Mux API credentials. Exposure of such sensitive information could potentially lead to non-compliance with data protection regulations like GDPR or HIPAA, which require safeguarding sensitive data against unauthorized access.

However, the provided information does not explicitly detail the impact on compliance with specific standards or regulations.

Useful 0 Not Useful 0