What’s Vulnerable › Vulnerabilities
CVE-2024-9926: Jetpack < 13.9.1 - Subscriber+ Arbitrary Feedback Access
- Severity: medium (CVSS 4.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.3% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2024-11-07 · updated 2026-06-17
Description
The Jetpack WordPress plugin does not have proper authorisation in one of its REST endpoint, allowing any authenticated users, such as subscriber to read arbitrary feedbacks data sent via the Jetpack Contact Form
Affected products
- Jetpack: from 13.1 before 13.1.4; from 13.2 before 13.2.3; from 13.3 before 13.3.2; from 13.4 before 13.4.4; from 13.8 before 13.8.2; 13.0, 13.5, 13.6, 13.7, 13.9 — fixed in 13.1.4, 13.2.3, 13.3.2, 13.4.4, 13.8.2
How to fix
Upgrade to a fixed version: Jetpack 13.1.4, 13.2.3, 13.3.2, 13.4.4. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2024-9926 or the next vulnerability affects your stack