CVEvulnerability

CVE-2024-9926

4.3 MEDIUM Published 2024-11-07 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2024-11-07
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Description

The Jetpack WordPress plugin does not have proper authorisation in one of its REST endpoint, allowing any authenticated users, such as subscriber to read arbitrary feedbacks data sent via the Jetpack Contact Form

Affected configurations

• automattic jetpack (>= 13.1 < 13.1.4) • automattic jetpack (>= 13.2 < 13.2.3) • automattic jetpack (>= 13.3 < 13.3.2) • automattic jetpack (>= 13.4 < 13.4.4) • automattic jetpack (>= 13.8 < 13.8.2) • automattic jetpack 13.0 • automattic jetpack 13.5 • automattic jetpack 13.6 • automattic jetpack 13.7 • automattic jetpack 13.9

References