The Automatic YouTube Gallery plugin for WordPress is not secure in versions prior to 2.3.3. This means that users with subscriber-level access or higher could make changes to the plugin settings without authorization. Specifically, they could update the plugin API key and delete the plugin cache.