A critical vulnerability in Plex Media Server allows unauthenticated remote attackers to manipulate plugin functions, potentially leading to unauthorized system interactions.

The flaw is an improper neutralization of encoded URI schemes (CWE-84) within the searchOne function. An unauthenticated attacker can craft malicious requests to invoke arbitrary plugin functions and supply custom parameters to those functions.

The ability for an unauthenticated remote attacker to interact with plugin functions presents a significant security risk. Successful exploitation could lead to unauthorized configuration changes, data exposure, or the triggering of unintended administrative actions within the media server environment. While the CVSS score is 6.5, the potential for arbitrary function execution necessitates prompt remediation to prevent broader system compromise.

Immediate Action: Update Plex Media Server to version 1.43.3.10861 or later immediately to incorporate the necessary input validation fixes.

Proactive Monitoring: Audit server access logs for anomalous requests directed at the searchOne endpoint or unexpected plugin-related activity.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block requests containing suspicious URL-encoded parameters targeted at the searchOne function.

Public Exploit Available: No

Given the ease of access for unauthenticated parties, administrators should prioritize updating to the patched version of Plex Media Server. Failure to patch leaves the underlying plugin architecture exposed to remote manipulation, which could be leveraged to bypass intended security controls. Apply the update as soon as possible to maintain the integrity of your media infrastructure.