CVE-2024-9926: Jetpack < 13.9.1 - Subscriber+ Arbitrary Feedback Access

Description

The Jetpack WordPress plugin does not have proper authorisation in one of its REST endpoint, allowing any authenticated users, such as subscriber to read arbitrary feedbacks data sent via the Jetpack Contact Form

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

Low

Integrity

None

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)1.3% · higher than 70% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

JE

Jetpack ·

13.9 before 13.9.1; 13.8 before 13.8.2; 13.7 before 13.7.1; 13.6 before 13.6.1; 13.5 before 13.5.1; 13.4 before 13.4.4; +34 more · source: vendor, NVD, CISA