CVE-2026-39614

MediumCVSS 5.4

Published: 08/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

6th percentile - higher than 6% of all known CVEs

Summary

The JW Player for WordPress plugin lacks authorization, allowing an attacker to exploit incorrectly configured access control security levels.

Risk Assessment

Risk of unauthorized access to administrative functions or data, potentially leading to privilege escalation.

Recommendation

Update the JW Player for WordPress plugin to the latest version.

Original NVD description (English source)

Missing Authorization vulnerability in ilGhera JW Player for WordPress jw-player-7-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JW Player for WordPress: from n/a through <= 2.3.6.