You’re going to need to back up your claim otherwise you might as well be lying as there’s no CVE like this I can find nor any public disclosure.

Plex have a bug bounty program and a responsive security team too.

Post your security report.