{
 "id": "WPSEC-2026-0658",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0658/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0658/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0658/index.md",
 "title": "Jetpack VideoPress <= 3.6 - Missing Authorization to Restricted Video Playback via Subscription Plan ID",
 "description": "The Jetpack VideoPress plugin for WordPress is vulnerable to unauthorized access of restricted videos in versions 1.7 up to, and including, 3.6. When issuing a video playback token, the plugin trusted the subscription plan ID sent with the request and granted access to any visitor with an active paid subscription to that plan, overriding the video's privacy setting and the subscription gate that actually applied to the post embedding the video, and it did not check that the embedding post was published. This makes it possible for attackers who hold a paid subscription to any plan on the site to obtain playback access to private videos and to videos gated behind other plans. Exploitation requires Jetpack's paid subscription features to be active on the site.",
 "plugin": {
  "slug": "jetpack-videopress",
  "name": "Jetpack VideoPress",
  "full_name": "Jetpack VideoPress",
  "wordpress_org": "https://wordpress.org/plugins/jetpack-videopress/",
  "advisories_url": "https://wpsec.com/vuln/plugin/jetpack-videopress/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/jetpack-videopress"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "1.7",
    "from_inclusive": true,
    "to": "3.7",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 1.7 before 3.7"
  ]
 },
 "introduced_in": "1.7",
 "fixed_in": "3.7",
 "remediation": "Update to 3.7 or later.",
 "fix_released": "2026-10-07T14:07:35+00:00",
 "published": "2026-10-08T14:54:41+00:00",
 "updated": "2026-10-07T18:24:43.293010+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0658/",
  "https://plugins.svn.wordpress.org/jetpack-videopress/tags/3.7/",
  "https://wordpress.org/plugins/jetpack-videopress/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/jetpack-videopress",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-08"
 }
}