A missing authorization flaw in the ilGhera JW Player for WordPress plugin enables users without proper privileges to bypass the plugin's configured access‑control settings and view media files that should remain restricted. The weakness is classified as a classic authorization bypass, documented as CWE‑862, and can lead to the exposure of confidential audio or video assets. Because the plugin controls media delivery, an attacker could retrieve large amounts of proprietary content or manipulate it, impacting confidentiality and integrity.

The issue affects the JW Player for WordPress plugin released by ilGhera. All publicly available versions up to and including 2.3.6 are vulnerable. Earlier releases are not explicitly listed but are presumed affected unless later versions are known to fix the issue.

Exploitation requires only web access to a WordPress site hosting the affected plugin; an attacker can send requests to the plugin’s media endpoints to retrieve hidden files. The CVE metadata does not provide an official CVSS or EPSS score, but bypassing access control is inherently critical. The vulnerability is not recorded in the CISA KEV catalog. Because no privileges such as authentication are required, the risk remains high for any site with the plugin installed.