EUVD-2026-96542
GHSA-hqxm-q759-7c9m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRegister/obtain Subscriber account
-
ExploitAuthenticate to WordPress site
-
ExecutionCall VideoPress action missing authorization check
-
ImpactPerform unauthorized integrity-impacting operation
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated WordPress account at Subscriber level (the lowest standard role) on a site running Jetpack VideoPress version 3.6 or earlier; this matches PR:L in the CVSS vector. The limiting factor is that the attacker must first hold valid credentials - exploitation is not possible for fully unauthenticated attackers - though on sites that permit open user registration, obtaining a Subscriber account is trivial. The specific VideoPress feature/endpoint lacking the authorization check is not named in the description, and no vendor advisory detailing affected configurations is provided; impact is limited to integrity (data modification), with no confidentiality or availability effect per the vector. |
| Impact | This is a moderate-priority issue, not a top-tier emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 6.5) describes a network-reachable, low-complexity flaw requiring low privileges (PR:L) - consistent with the 'Subscriber Broken Access Control' description, meaning an attacker needs a valid but minimally-privileged Subscriber account. Impact is integrity-only (I:H) with no confidentiality or availability effect, matching CWE-862 (Missing Authorization) where a low-privilege user can invoke functionality they should not. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The signals are internally consistent (description's 'Subscriber' requirement aligns with PR:L), so there is no CVSS-vs-description conflict here; however, the single source (Patchstack) and absence of a vendor/Automattic advisory in the references limit corroboration. Overall: a legitimate flaw worth patching, but the authentication requirement and integrity-only impact keep real-world risk below that of unauthenticated or RCE-class issues. |
| Exploit ScenarioDerived | An attacker registers or obtains a low-privilege Subscriber account on a WordPress site running Jetpack VideoPress 3.6 or earlier, then invokes a VideoPress action or endpoint that fails to verify the user's authorization level. Because the attack is network-based with low complexity and no user interaction, the authenticated attacker can modify or manipulate VideoPress-managed data they should not have access to. No public exploit code was identified in the supplied data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Missing authorization checks in the Jetpack VideoPress WordPress plugin versions 3.6 and earlier let an authenticated Subscriber-level account perform actions that should be limited to higher-privileged users, giving a low-privileged attacker the ability to modify data (integrity impact only, with no confidentiality or availability effect per the assessed CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base score 6.5). Sites are exposed if they run an affected plugin version and allow the attacker to obtain a Subscriber account, which is trivial on installations with open user registration enabled; fully unauthenticated attackers cannot exploit the flaw. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing), so this is a moderate-priority hardening item rather than an emergency, though the absence of a named vulnerable endpoint in the published advisory makes the true reachable surface hard to bound.
RemediationAI
Apply the vendor fix by updating Jetpack VideoPress to a release later than 3.6, which the advisory lists as the last affected version, and verify the patched version and any residual caveats against the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/jetpack-videopress/vulnerability/wordpress-jetpack-videopress-plugin-3-6-broken-access-control-vulnerability?_s_id=cve); because the input data does not confirm an exact fixed build number, check the WordPress.org plugin changelog or Automattic release notes before assuming the update closes the issue. If immediate patching is not possible, deactivate the VideoPress plugin on sites that do not need video hosting (side effect: embedded VideoPress content and video playback on the site will break), or, if it must stay active, disable open user registration and require administrator approval for new accounts, audit and remove unused Subscriber accounts, and add a WAF or mu-plugin rule that denies Subscriber-role requests to VideoPress administrative endpoints - noting that such request filtering is brittle if normal VideoPress front-end behavior shares those routes and may block legitimate playback or embedding. Sites that can neither patch nor restrict registration should treat any Subscriber-authenticated user as able to modify video-related data, and monitor plugin settings and video objects for unexpected changes while a fix is planned.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic Missing Authorization (CWE-862) defect in a WordPress plugin, meaning a function or REST/AJAX handler that performs a state-changing operation fails to verify that the calling user holds the required capability (WordPress's current_user_can checks, e.g. edit_posts, manage_options, or the plugin's own capability) before acting. VideoPress is Automattic's video hosting and embedding service integrated with the Jetpack plugin family, so the affected code paths are the plugin's administrative endpoints for uploading, updating, or otherwise managing video-related resources. The CPE cpe:2.3:a:automattic:jetpack_videopress:*:*:*:*:*:*:*:* identifies the standalone WordPress plugin from Automattic as the affected component across versions up to and including 3.6. The CVSS vector's PR:L is consistent with the assessed precondition that the attacker must already hold a valid low-privilege (Subscriber) WordPress session, and the N/N/N profile on confidentiality and availability confirms the defect is a write/state-change authorization gap rather than an information disclosure or denial-of-service vector. Because the advisory does not name the exact endpoint or capability that is missing its check, defenders should treat the whole plugin's Subscriber-reachable surface as the candidate attack area.
Know when Jetpack Videopress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Subscriber account needed so PR:L; network-reachable WordPress endpoint with no interaction gives AV:N/AC:L/UI:N; missing-authorization yields integrity-only impact (I:H, C:N, A:N).
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Subscriber Broken Access Control in Jetpack VideoPress <= 3.6 versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB