Jetpack – WP Security, Backup, Speed, & Growth

The Jetpack – WP Security, Backup, Speed, & Growth plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 16.2. This makes it possible for unauthenticated attackers to perform an unauthorized action.

The Jetpack – WP Security, Backup, Speed, & Growth plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 16.2. This makes it possible for unauthenticated attackers to perform an unauthorized action.

The Jetpack – WP Security, Backup, Speed, & Growth plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions 16.1 through 16.1.2. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Jetpack – WP Security, Backup, Speed, & Growth plugin for WordPress is vulnerable to PHP Object Injection in versions 16.1 through 16.1.2. This is due to deserialization of untrusted input. This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

The Jetpack – WP Security, Backup, Speed, & Growth plugin for WordPress is vulnerable to PHP Object Injection in versions 16.1 through 16.1.2. This is due to deserialization of untrusted input. This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

The Jetpack – WP Security, Backup, Speed, & Growth plugin for WordPress is vulnerable to PHP Object Injection in versions 12.0 through 16.1.2 via deserialization of untrusted post metadata in the Jetpack Import REST API. This makes it possible for authenticated attackers with the import capability, which is granted to administrators by default, to inject a PHP object. The direct impact is attacker-controlled object instantiation; confidentiality, integrity, and availability impact requires a compatible POP chain in Jetpack or another installed component.

The Jetpack – WP Security, Backup, Speed, & Growth plugin for WordPress is vulnerable to Missing Authorization in versions 3.2 through 16.1.2 via the WPCOM JSON API media upload and update endpoints. Early releases accepted the destination as post_ID, while later releases used parent_id; both values were written to an attachment’s post_parent without checking whether the caller could edit the destination post. Authorization was limited to upload_files and, in later update implementations, permission to edit the media item itself. This makes it possible for authenticated attackers with an account linked to the Jetpack connection and the upload_files capability, which is Author and above by default, to attach an arbitrary media item to a post they do not own. Where the target post uses a bare [gallery] shortcode or a theme that calls get_attached_media()/get_children(), the attacker's media then renders inside the victim's post. The endpoints are reached only through the WordPress.com HMAC-signed jetpack.jsonAPI XML-RPC proxy, not via a /wp-json route.

The Jetpack – WP Security, Backup, Speed, & Growth plugin for WordPress is vulnerable to Cross-Site Scripting in versions 14.5 through 16.1.2 via the Reader repost initializer in the block editor bundles. The initializer reads the url, title, text, comment_content, and comment_author query parameters and interpolates them into block attributes without escaping or sanitization before calling resetEditorBlocks(). On WordPress 7.1, only title and url were demonstrated to persist into live executable markup; the other parameters did not produce a stored executable sink. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into a post via a crafted link that, when opened and saved by a user with the unfiltered_html capability (administrator or editor by default), stores the payload in post_content where it executes in the browser of every subsequent visitor to the published post. The Blocks module must be active and the site must be Jetpack-connected or in offline mode for the vulnerable bundle to be enqueued.