CVE-2024-9926

Jetpack < 13.9.1 - Subscriber+ Arbitrary Feedback Access

Published Nov 7, 2024 CVSS 3.1 · 4.3 Medium EPSS 1.3% KEV · Not listed
Description
The Jetpack WordPress plugin does not have proper authorisation in one of its REST endpoint, allowing any authenticated users, such as subscriber to read arbitrary feedbacks data sent via the Jetpack Contact Form

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Weaknesses NVD-CWE-noinfo
CPEs cpe:2.3:a:automattic:jetpack:13.0:*:*:*:*:wordpress:*:*
cpe:2.3:a:automattic:jetpack:13.5:*:*:*:*:wordpress:*:*
cpe:2.3:a:automattic:jetpack:13.6:*:*:*:*:wordpress:*:*
cpe:2.3:a:automattic:jetpack:13.7:*:*:*:*:wordpress:*:*
cpe:2.3:a:automattic:jetpack:13.9:*:*:*:*:wordpress:*:*
Type Values Removed Values Added
First Time appeared Automattic
Automattic jetpack
CPEs cpe:2.3:a:automattic:jetpack:*:*:*:*:*:wordpress:*:*
Vendors & Products Automattic
Automattic jetpack
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Type Values Removed Values Added
Description The Jetpack WordPress plugin does not have proper authorisation in one of its REST endpoint, allowing any authenticated users, such as subscriber to read arbitrary feedbacks data sent via the Jetpack Contact Form
Title Jetpack < 13.9.1 - Subscriber+ Arbitrary Feedback Access
References
Weaknesses

Sources

Status
PUBLISHED
Assigner
WPScan
Published
Updated
Nov 7, 2024, 7:53 PM
Reserved
Oct 14, 2024, 9:27 AM
Status
Analyzed
Published
Nov 7, 2024, 3:15 PM
Modified
Jun 17, 2026, 8:25 AM