Riskcovery

CVE-2024-9926

Jetpack < 13.9.1 - Subscriber+ Arbitrary Feedback Access

State
Published
Severity
4.3 Medium
Published
Nov 7, 2024
Updated
Nov 7, 2024
Reserved
Oct 14, 2024

Read the record on cve.org

Description

The Jetpack WordPress plugin does not have proper authorisation in one of its REST endpoint, allowing any authenticated users, such as subscriber to read arbitrary feedbacks data sent via the Jetpack Contact Form

Scores

CVSSScoreVectorSource
3.14.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NCISA-ADP

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
JetpackUnknown
  • 13.9 to before 13.9.1Affected
JetpackUnknown
  • 13.8 to before 13.8.2Affected
JetpackUnknown
  • 13.7 to before 13.7.1Affected
JetpackUnknown
  • 13.6 to before 13.6.1Affected
JetpackUnknown
  • 13.5 to before 13.5.1Affected
JetpackUnknown
  • 13.4 to before 13.4.4Affected
JetpackUnknown
  • 13.3 to before 13.3.2Affected
JetpackUnknown
  • 13.2 to before 13.2.3Affected
JetpackUnknown
  • 13.1 to before 13.1.4Affected
JetpackUnknown
  • 13.0 to before 13.0.1Affected
JetpackUnknown
  • 12.9 to before 12.9.4Affected
JetpackUnknown
  • 12.8 to before 12.8.2Affected
JetpackUnknown
  • 12.7 to before 12.7.2Affected
JetpackUnknown
  • 12.6 to before 12.6.3Affected
JetpackUnknown
  • 12.5 to before 12.5.1Affected
JetpackUnknown
  • 12.4 to before 12.4.1Affected
JetpackUnknown
  • 12.3 to before 12.3.1Affected
JetpackUnknown
  • 12.2 to before 12.2.2Affected
JetpackUnknown
  • 12.1 to before 12.1.2Affected
JetpackUnknown
  • 12.0 to before 12.0.2Affected
JetpackUnknown
  • 11.9 to before 11.9.3Affected
JetpackUnknown
  • 11.8 to before 11.8.6Affected
JetpackUnknown
  • 11.7 to before 11.7.3Affected
JetpackUnknown
  • 11.6 to before 11.6.2Affected
JetpackUnknown
  • 11.5 to before 11.5.3Affected
JetpackUnknown
  • 11.4 to before 11.4.2Affected
JetpackUnknown
  • 11.3 to before 11.3.4Affected
JetpackUnknown
  • 11.2 to before 11.2.2Affected
JetpackUnknown
  • 11.1 to before 11.1.4Affected
JetpackUnknown
  • 11.0 to before 11.0.2Affected
JetpackUnknown
  • 10.9 to before 10.9.3Affected
JetpackUnknown
  • 10.8 to before 10.8.2Affected
JetpackUnknown
  • 10.7 to before 10.7.2Affected
JetpackUnknown
  • 10.6 to before 10.6.2Affected
JetpackUnknown
  • 10.5 to before 10.5.3Affected
JetpackUnknown
  • 10.4 to before 10.4.2Affected
JetpackUnknown
  • 10.3 to before 10.3.2Affected
JetpackUnknown
  • 10.2 to before 10.2.3Affected
JetpackUnknown
  • 10.1 to before 10.1.2Affected
JetpackUnknown
  • 10.0 to before 10.0.2Affected
JetpackUnknown
  • 9.9 to before 9.9.3Affected
JetpackUnknown
  • 9.8 to before 9.8.3Affected
JetpackUnknown
  • 9.7 to before 9.7.3Affected
JetpackUnknown
  • 9.6 to before 9.6.4Affected
JetpackUnknown
  • 9.5 to before 9.5.5Affected
JetpackUnknown
  • 9.4 to before 9.4.4Affected
JetpackUnknown
  • 9.3 to before 9.3.5Affected
JetpackUnknown
  • 9.2 to before 9.2.4Affected
JetpackUnknown
  • 9.1 to before 9.1.3Affected
JetpackUnknown
  • 9.0 to before 9.0.5Affected
JetpackUnknown
  • 8.9 to before 8.9.4Affected
JetpackUnknown
  • 8.8 to before 8.8.5Affected
JetpackUnknown
  • 8.7 to before 8.7.4Affected
JetpackUnknown
  • 8.6 to before 8.6.4Affected
JetpackUnknown
  • 8.5 to before 8.5.3Affected
JetpackUnknown
  • 8.4 to before 8.4.5Affected
JetpackUnknown
  • 8.3 to before 8.3.3Affected
JetpackUnknown
  • 8.2 to before 8.2.6Affected
JetpackUnknown
  • 8.1 to before 8.1.4Affected
JetpackUnknown
  • 8.0 to before 8.0.3Affected
JetpackUnknown
  • 7.9 to before 7.9.4Affected
JetpackUnknown
  • 7.8 to before 7.8.4Affected
JetpackUnknown
  • 7.7 to before 7.7.6Affected
JetpackUnknown
  • 7.6 to before 7.6.4Affected
JetpackUnknown
  • 7.5 to before 7.5.7Affected
JetpackUnknown
  • 7.4 to before 7.4.5Affected
JetpackUnknown
  • 7.3 to before 7.3.5Affected
JetpackUnknown
  • 7.2 to before 7.2.5Affected
JetpackUnknown
  • 7.1 to before 7.1.5Affected
JetpackUnknown
  • 7.0 to before 7.0.5Affected
JetpackUnknown
  • 6.9 to before 6.9.4Affected
JetpackUnknown
  • 6.8 to before 6.8.5Affected
JetpackUnknown
  • 6.7 to before 6.7.4Affected
JetpackUnknown
  • 6.6 to before 6.6.5Affected
JetpackUnknown
  • 6.5 to before 6.5.4Affected
JetpackUnknown
  • 6.4 to before 6.4.6Affected
JetpackUnknown
  • 6.3 to before 6.3.7Affected
JetpackUnknown
  • 6.2 to before 6.2.5Affected
JetpackUnknown
  • 6.1 to before 6.1.5Affected
JetpackUnknown
  • 6.0 to before 6.0.4Affected
JetpackUnknown
  • 5.9 to before 5.9.4Affected
JetpackUnknown
  • 5.8 to before 5.8.4Affected
JetpackUnknown
  • 5.7 to before 5.7.5Affected
JetpackUnknown
  • 5.6 to before 5.6.5Affected
JetpackUnknown
  • 5.5 to before 5.5.5Affected
JetpackUnknown
  • 5.4 to before 5.4.4Affected
JetpackUnknown
  • 5.3 to before 5.3.4Affected
JetpackUnknown
  • 5.2 to before 5.2.5Affected
JetpackUnknown
  • 5.1 to before 5.1.4Affected
JetpackUnknown
  • 5.0 to before 5.0.3Affected
JetpackUnknown
  • 4.9 to before 4.9.3Affected
JetpackUnknown
  • 4.8 to before 4.8.5Affected
JetpackUnknown
  • 4.7 to before 4.7.4Affected
JetpackUnknown
  • 4.6 to before 4.6.3Affected
JetpackUnknown
  • 4.5 to before 4.5.3Affected
JetpackUnknown
  • 4.4 to before 4.4.5Affected
JetpackUnknown
  • 4.3 to before 4.3.5Affected
JetpackUnknown
  • 4.2 to before 4.2.5Affected
JetpackUnknown
  • 4.1.0 to before 4.1.4Affected
JetpackUnknown
  • 4.0.0 to before 4.0.7Affected
JetpackUnknown
  • 3.9.2 to before 3.9.10Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.