CVE-2026-27422

WordPress YT Player plugin <= 2.0.9 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in YT Player <= 2.0.9 versions.

We have discovered 542 live websites that are affected by CVE-2026-27422.

Run a Free Instant Scan



Affected Software

Product  Yt Player
Category Wordpress Plugins
Vulnerable Domains542 live websites (98% of Yt Player install base)
Vulnerable Versions
  • from 0 through 2.0.9
Vulnerable Versions Count16 versions ( 94% of all versions)


Common Weakness Enumeration

CWE-862 Missing Authorization



Details

  • Published - Jul 23, 2026
  • Updated - Jul 23, 2026

Credits

  • Que Thanh Tuan | Patchstack Bug Bounty Program (finder)

Website Distribution by Country

Number of websites using CVE-2026-27422
United States170 websites


Germany64 websites
Poland38 websites
France32 websites
Italy28 websites
GB20 websites
Netherlands20 websites
Brazil18 websites
Russia11 websites
Canada11 websites

Website Distribution by TLD

Number of websites using CVE-2026-27422
.com231 websites
.de30 websites
.pl29 websites
.org29 websites
.it19 websites
.nl15 websites
.fr14 websites
.net12 websites
.com.br10 websites
.co.uk7 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-27422

Top websites that are affected by CVE-2026-27422. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
********.org United States***,***
**********************.pl Poland***,***
***.*********.eu Germany***,***
*********.com United States*,***,***
*****.***.***.pl Poland*,***,***
*********.com United States*,***,***
********.it Italy*,***,***
****.***.br Brazil*,***,***
****.***.co Colombia*,***,***
*******.com Cyprus*,***,***
See full domain list

FAQ

CVE-2026-27422 is Missing Authorization in Yt Player
A total of 542 websites have been identified as vulnerable to CVE-2026-27422, based on global website indexing conducted by WebTechSurvey.
The Yt Player is affected by the CVE-2026-27422 vulnerability.
Yt Player versions up to and including 2.0.9 are vulnerable to CVE-2026-27422.