CVE-2026-40808: WordPress Jetpack VideoPress plugin <= 3.6 - Broken Access Control vulnerability
Published Oct 10, 2026
·Updated
Subscriber Broken Access Control in Jetpack VideoPress <= 3.6 versions.
Affected Software
1 affected component
Automattic Jetpack VideoPress<=3.6
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Jetpack VideoPress pluginto a version that resolves this vulnerability.Fixed in 3.7
Event History
Oct 10, 2026
CVE Published
via MITRE·07:35 PM
Data Sourced
via MITRE·07:35 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·08:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The vulnerability requires an authenticated account with Subscriber-level privileges. No user interaction is required, and it can be exploited over the network.
2
What is the likely security impact?
The reported impact is unauthorized modification of data or functionality through broken access control. The available information indicates no confidentiality impact and no availability impact.
3
Which plugin versions are affected?
Jetpack VideoPress versions 3.6 and earlier are identified as affected.