CVE-2024-9926

Jetpack < 13.9.1 - Subscriber+ Arbitrary Feedback Access

Medium · published November 7, 2024

CVSS v3.1
4.3
EPSS
1%
Percentile
69.9
In the wild
Unconfirmed
What it is

The Jetpack WordPress plugin does not have proper authorisation in one of its REST endpoint, allowing any authenticated users, such as subscriber to read arbitrary feedbacks data sent via the Jetpack Contact Form

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01283 · 69.9th percentile
Published
2024-11-07T15:02Z
EPSS history
Timeline
  • 07 NOV 15:02Z
    Jetpack < 13.9.1 - Subscriber+ Arbitrary Feedback Access
    cvelistv5