The ilGhera JW Player for WordPress plugin contains a missing authorization check that permits unauthenticated users to access certain plugin functionalities. This lack of proper access control is identified as CWE‑862 and can potentially expose restricted media content or plugin configuration data to non‑privileged users. The vulnerability does not claim the ability to alter data; it specifically concerns the ability to view content that should be protected.

All WordPress installations that use the ilGhera JW Player for WordPress plugin up through version 2.3.6 are affected. Site administrators should verify the installed plugin version and check whether any instances of the plugin are present on their sites.

The medium CVSS score of 5.4 indicates a moderate level of risk, while the EPSS score of less than 1% suggests that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Based on the description of a missing authorization mechanism, the likely attack vector involves crafted HTTP requests to plugin endpoints that do not enforce proper access checks. Because no proof‑of‑concept is available publicly, the exact exploitation requirements remain inferred, but the risk remains that attackers could retrieve restricted media or configuration information.