CVE-2026-40808: WordPress Jetpack VideoPress plugin <= 3.6 - Broken Access Control vulnerability

Q: What level of access does an attacker need to exploit this issue?

The vulnerability requires an authenticated account with Subscriber-level privileges. No user interaction is required, and it can be exploited over the network.

Q: What is the likely security impact?

The reported impact is unauthorized modification of data or functionality through broken access control. The available information indicates no confidentiality impact and no availability impact.

Q: Which plugin versions are affected?

Jetpack VideoPress versions 3.6 and earlier are identified as affected.

Published Oct 10, 2026

Updated

Subscriber Broken Access Control in Jetpack VideoPress <= 3.6 versions.

Affected Software

1 affected component

Automattic Jetpack VideoPress<=3.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Jetpack VideoPress plugin to a version that resolves this vulnerability.
Fixed in 3.7

Event History

Oct 10, 2026

CVE Published

via MITRE·07:35 PM

Data Sourced

via MITRE·07:35 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·08:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The vulnerability requires an authenticated account with Subscriber-level privileges. No user interaction is required, and it can be exploited over the network.

What is the likely security impact?

The reported impact is unauthorized modification of data or functionality through broken access control. The available information indicates no confidentiality impact and no availability impact.

Which plugin versions are affected?

Jetpack VideoPress versions 3.6 and earlier are identified as affected.

CVE-2026-40808: WordPress Jetpack VideoPress plugin <= 3.6 - Broken Access Control vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What is the likely security impact?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What is the likely security impact?

Which plugin versions are affected?