What is the CVSS score of CVE-2026-39614?

CVE-2026-39614 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-39614

Q: Which versions of WordPress are affected by CVE-2026-39614?

JW Player for WordPress plugin versions through 2.3.6 allows authenticated users to bypass authorization controls and access or modify restricted functionality due to improper access control checks.

EUVD-2026-20251 MEDIUM

Missing Authorization (CWE-862)

2026-04-08 Patchstack

GHSA-665f-vrmf-89j8

Authentication Bypass WordPress

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 12:41 vuln.today

CVSS changed

Apr 13, 2026 - 19:37 NVD

5.4 (MEDIUM)

EUVD ID Assigned

Apr 08, 2026 - 08:45 euvd

EUVD-2026-20251

CVE Published

Apr 08, 2026 - 08:30 nvd

N/A

DescriptionCVE.org

Missing Authorization vulnerability in ilGhera JW Player for WordPress jw-player-7-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JW Player for WordPress: from n/a through <= 2.3.6.

AnalysisAI

JW Player for WordPress plugin versions through 2.3.6 allows authenticated users to bypass authorization controls and access or modify restricted functionality due to improper access control checks. An attacker with low-privilege WordPress user credentials can exploit this vulnerability to read sensitive data or perform unauthorized actions normally restricted to administrators, with no user interaction required.

Technical ContextAI

The vulnerability stems from a Missing Authorization (CWE-862) flaw in the JW Player for WordPress plugin (cpe:2.3:a:ilghera:jw_player_for_wordpress:*:*:*:*:*:*:*:*), affecting all versions up to and including 2.3.6. The plugin fails to properly validate user privileges before allowing access to sensitive endpoints or functions. CWE-862 represents the absence of proper authorization checks-the application does not verify whether a user has permission to perform a requested action. In WordPress context, this typically manifests as inadequate nonce verification, missing capability checks (has_cap()), or direct access to functions that should require administrative privileges. The plugin likely exposes AJAX endpoints or internal functions without proper permission validation, allowing any authenticated user (even with subscriber-level access) to interact with functionality intended only for administrators.

RemediationAI

Update JW Player for WordPress to a patched version released after 2.3.6. Administrators should navigate to the WordPress Plugins dashboard, locate JW Player for WordPress, and apply the available update immediately. In the interim, restrict WordPress user registrations to trusted accounts only and audit existing user accounts to remove unnecessary subscriber or low-privilege accounts. Disable the JW Player plugin entirely if an update is not immediately available and the plugin functionality is not critical. For additional guidance, consult the Patchstack vulnerability advisory at https://patchstack.com/database/Wordpress/Plugin/jw-player-7-for-wp/vulnerability/wordpress-jw-player-for-wordpress-plugin-2-3-6-broken-access-control-vulnerability?_s_id=cve and the NVD CVE record at https://nvd.nist.gov/vuln/detail/CVE-2026-39614.