A broken access control flaw in the Jetpack VideoPress plugin allows an attacker to view videos that should be restricted to subscribed users. The vulnerability is a classic access‑control failure, meaning that users who are not authenticated or do not have the required permissions can still retrieve protected media. This can lead to confidentiality violations of private video content and expose user‑generated media to the public.

Automattic’s Jetpack VideoPress plugin for WordPress, versions 3.6 and earlier. Sites running any of these versions are susceptible and could expose subscriber‑only videos to unauthenticated users.

The CVSS score of 6.5 indicates a medium‑to‑high severity vulnerability. Because the plugin operates within a web environment, the likely attack vector is remote through HTTP requests; however, the public description does not specify any other prerequisites. The EPSS score is not available, and the vulnerability is not listed in CISA KEV catalogs. Attackers that can reach the WordPress site can exploit this flaw to retrieve private videos, which poses a significant confidentiality risk.