TI-2023-02806 Aliases CVE-2023-2996 GHSA-qhhp-34vh-xjwv

Jetpack < 12.1.1 - Author+ Arbitrary File Manipulation via API

HIGH 73Published 2023-06-27 · Updated 2024-12-05

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

The Jetpack WordPress plugin before 12.1.1 does not validate uploaded files, allowing users with author roles or above to manipulate existing files on the site, deleting arbitrary files, and in rare cases achieve Remote Code Execution via phar deserialization.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.04824 92nd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA and NVD

Fix Fixed Jetpack (Unknown): 2.0.9, 2.1.7, 2.2.10 +99

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Unknown	Jetpack	1.9 to before 2.0.9; 2.1 to before 2.1.7; 2.2 to before 2.2.10; 2.3 to before 2.3.10; 2.4 to before 2.4.7; 2.5 to before 2.5.5; 2.6 to before 2.6.6; 2.7 to before 2.7.5; 2.8 to before 2.8.5; 2.9 to before 2.9.6; 3.0 to before 3.0.6; 3.1 to before 3.1.5; 3.2 to before 3.2.5; 3.3 to before 3.3.6; 3.4 to before 3.4.6; 3.5 to before 3.5.6; 3.6 to before 3.6.4; 3.7 to before 3.7.5; 3.8 to before 3.8.5; 3.9 to before 3.9.9; 4.0 to before 4.0.6; 4.1 to before 4.1.3; 4.2 to before 4.2.4; 4.3 to before 4.3.4; 4.4 to before 4.4.4; 4.5 to before 4.5.2; 4.6 to before 4.6.2; 4.7 to before 4.7.3; 4.8 to before 4.8.4; 4.9 to before 4.9.2; 5.0 to before 5.0.2; 5.1 to before 5.1.3; 5.2 to before 5.2.4; 5.3 to before 5.3.3; 5.4 to before 5.4.3; 5.5 to before 5.5.4; 5.6 to before 5.6.4; 5.7 to before 5.7.4; 5.8 to before 5.8.3; 5.9 to before 5.9.3; 6.0 to before 6.0.3; 6.1 to before 6.1.4; 6.2 to before 6.2.4; 6.3 to before 6.3.6; 6.4 to before 6.4.5; 6.5 to before 6.5.3; 6.6 to before 6.6.4; 6.7 to before 6.7.3; 6.8 to before 6.8.4; 6.9 to before 6.9.3; 7.0 to before 7.0.4; 7.1 to before 7.1.4; 7.2 to before 7.2.4; 7.3 to before 7.3.4; 7.4 to before 7.4.4; 7.5 to before 7.5.6; 7.6 to before 7.6.3; 7.7 to before 7.7.5; 7.8 to before 7.8.3; 7.9 to before 7.9.3; 8.0 to before 8.0.2; 8.1 to before 8.1.3; 8.2 to before 8.2.5; 8.3 to before 8.3.2; 8.4 to before 8.4.4; 8.5 to before 8.5.2; 8.6 to before 8.6.3; 8.7 to before 8.7.3; 8.8 to before 8.8.4; 8.9 to before 8.9.3; 9.0 to before 9.0.4; 9.1 to before 9.1.2; 9.2 to before 9.2.3; 9.3 to before 9.3.4; 9.4 to before 9.4.3; 9.5 to before 9.5.4; 9.6 to before 9.6.3; 9.7 to before 9.7.2; 9.8 to before 9.8.2; 9.9 to before 9.9.2; 10.0 to before 10.0.1; 10.1 to before 10.1.1; 10.2 to before 10.2.2; 10.3 to before 10.3.1; 10.4 to before 10.4.1; 10.5 to before 10.5.2; 10.6 to before 10.6.2; 10.7 to before 10.7.1; 10.8 to before 10.8.1; 10.9 to before 10.9.2; 11.0 to before 11.0.1; 11.1 to before 11.1.3; 11.2 to before 11.2.1; 11.3 to before 11.3.3; 11.4 to before 11.4.1; 11.5 to before 11.5.2; 11.6 to before 11.6.1; 11.7 to before 11.7.2; 11.8 to before 11.8.5; 11.9 to before 11.9.2; 12.0 to before 12.0.1; 12.1 to before 12.1.1	2.0.9, 2.1.7, 2.2.10, 2.3.10, 2.4.7, 2.5.5, 2.6.6, 2.7.5, 2.8.5, 2.9.6, 3.0.6, 3.1.5, 3.2.5, 3.3.6, 3.4.6, 3.5.6, 3.6.4, 3.7.5, 3.8.5, 3.9.9, 4.0.6, 4.1.3, 4.2.4, 4.3.4, 4.4.4, 4.5.2, 4.6.2, 4.7.3, 4.8.4, 4.9.2, 5.0.2, 5.1.3, 5.2.4, 5.3.3, 5.4.3, 5.5.4, 5.6.4, 5.7.4, 5.8.3, 5.9.3, 6.0.3, 6.1.4, 6.2.4, 6.3.6, 6.4.5, 6.5.3, 6.6.4, 6.7.3, 6.8.4, 6.9.3, 7.0.4, 7.1.4, 7.2.4, 7.3.4, 7.4.4, 7.5.6, 7.6.3, 7.7.5, 7.8.3, 7.9.3, 8.0.2, 8.1.3, 8.2.5, 8.3.2, 8.4.4, 8.5.2, 8.6.3, 8.7.3, 8.8.4, 8.9.3, 9.0.4, 9.1.2, 9.2.3, 9.3.4, 9.4.3, 9.5.4, 9.6.3, 9.7.2, 9.8.2, 9.9.2, 10.0.1, 10.1.1, 10.2.2, 10.3.1, 10.4.1, 10.5.2, 10.6.2, 10.7.1, 10.8.1, 10.9.2, 11.0.1, 11.1.3, 11.2.1, 11.3.3, 11.4.1, 11.5.2, 11.6.1, 11.7.2, 11.8.5, 11.9.2, 12.0.1, 12.1.1	Patch available	CNA

Jetpack VendorUnknown Affected 1.9 to before 2.0.9; 2.1 to before 2.1.7; 2.2 to before 2.2.10; 2.3 to before 2.3.10; 2.4 to before 2.4.7; 2.5 to before 2.5.5; 2.6 to before 2.6.6; 2.7 to before 2.7.5; 2.8 to before 2.8.5; 2.9 to before 2.9.6; 3.0 to before 3.0.6; 3.1 to before 3.1.5; 3.2 to before 3.2.5; 3.3 to before 3.3.6; 3.4 to before 3.4.6; 3.5 to before 3.5.6; 3.6 to before 3.6.4; 3.7 to before 3.7.5; 3.8 to before 3.8.5; 3.9 to before 3.9.9; 4.0 to before 4.0.6; 4.1 to before 4.1.3; 4.2 to before 4.2.4; 4.3 to before 4.3.4; 4.4 to before 4.4.4; 4.5 to before 4.5.2; 4.6 to before 4.6.2; 4.7 to before 4.7.3; 4.8 to before 4.8.4; 4.9 to before 4.9.2; 5.0 to before 5.0.2; 5.1 to before 5.1.3; 5.2 to before 5.2.4; 5.3 to before 5.3.3; 5.4 to before 5.4.3; 5.5 to before 5.5.4; 5.6 to before 5.6.4; 5.7 to before 5.7.4; 5.8 to before 5.8.3; 5.9 to before 5.9.3; 6.0 to before 6.0.3; 6.1 to before 6.1.4; 6.2 to before 6.2.4; 6.3 to before 6.3.6; 6.4 to before 6.4.5; 6.5 to before 6.5.3; 6.6 to before 6.6.4; 6.7 to before 6.7.3; 6.8 to before 6.8.4; 6.9 to before 6.9.3; 7.0 to before 7.0.4; 7.1 to before 7.1.4; 7.2 to before 7.2.4; 7.3 to before 7.3.4; 7.4 to before 7.4.4; 7.5 to before 7.5.6; 7.6 to before 7.6.3; 7.7 to before 7.7.5; 7.8 to before 7.8.3; 7.9 to before 7.9.3; 8.0 to before 8.0.2; 8.1 to before 8.1.3; 8.2 to before 8.2.5; 8.3 to before 8.3.2; 8.4 to before 8.4.4; 8.5 to before 8.5.2; 8.6 to before 8.6.3; 8.7 to before 8.7.3; 8.8 to before 8.8.4; 8.9 to before 8.9.3; 9.0 to before 9.0.4; 9.1 to before 9.1.2; 9.2 to before 9.2.3; 9.3 to before 9.3.4; 9.4 to before 9.4.3; 9.5 to before 9.5.4; 9.6 to before 9.6.3; 9.7 to before 9.7.2; 9.8 to before 9.8.2; 9.9 to before 9.9.2; 10.0 to before 10.0.1; 10.1 to before 10.1.1; 10.2 to before 10.2.2; 10.3 to before 10.3.1; 10.4 to before 10.4.1; 10.5 to before 10.5.2; 10.6 to before 10.6.2; 10.7 to before 10.7.1; 10.8 to before 10.8.1; 10.9 to before 10.9.2; 11.0 to before 11.0.1; 11.1 to before 11.1.3; 11.2 to before 11.2.1; 11.3 to before 11.3.3; 11.4 to before 11.4.1; 11.5 to before 11.5.2; 11.6 to before 11.6.1; 11.7 to before 11.7.2; 11.8 to before 11.8.5; 11.9 to before 11.9.2; 12.0 to before 12.0.1; 12.1 to before 12.1.1 Fixed in 2.0.9, 2.1.7, 2.2.10, 2.3.10, 2.4.7, 2.5.5, 2.6.6, 2.7.5, 2.8.5, 2.9.6, 3.0.6, 3.1.5, 3.2.5, 3.3.6, 3.4.6, 3.5.6, 3.6.4, 3.7.5, 3.8.5, 3.9.9, 4.0.6, 4.1.3, 4.2.4, 4.3.4, 4.4.4, 4.5.2, 4.6.2, 4.7.3, 4.8.4, 4.9.2, 5.0.2, 5.1.3, 5.2.4, 5.3.3, 5.4.3, 5.5.4, 5.6.4, 5.7.4, 5.8.3, 5.9.3, 6.0.3, 6.1.4, 6.2.4, 6.3.6, 6.4.5, 6.5.3, 6.6.4, 6.7.3, 6.8.4, 6.9.3, 7.0.4, 7.1.4, 7.2.4, 7.3.4, 7.4.4, 7.5.6, 7.6.3, 7.7.5, 7.8.3, 7.9.3, 8.0.2, 8.1.3, 8.2.5, 8.3.2, 8.4.4, 8.5.2, 8.6.3, 8.7.3, 8.8.4, 8.9.3, 9.0.4, 9.1.2, 9.2.3, 9.3.4, 9.4.3, 9.5.4, 9.6.3, 9.7.2, 9.8.2, 9.9.2, 10.0.1, 10.1.1, 10.2.2, 10.3.1, 10.4.1, 10.5.2, 10.6.2, 10.7.1, 10.8.1, 10.9.2, 11.0.1, 11.1.3, 11.2.1, 11.3.3, 11.4.1, 11.5.2, 11.6.1, 11.7.2, 11.8.5, 11.9.2, 12.0.1, 12.1.1 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:automattic:jetpack::::::wordpress::*	before 12.1.1	Vulnerable	Automattic

cpe:2.3:a:automattic:jetpack:*:*:*:*:*:wordpress:*:* Versions before 12.1.1 Vulnerable ·Automattic

Remediation

Fix · CNA Jetpack (Unknown) Fixed in 2.0.9, 2.1.7, 2.2.10, 2.3.10, 2.4.7, 2.5.5, 2.6.6, 2.7.5, 2.8.5, 2.9.6, 3.0.6, 3.1.5, 3.2.5, 3.3.6, 3.4.6, 3.5.6, 3.6.4, 3.7.5, 3.8.5, 3.9.9, 4.0.6, 4.1.3, 4.2.4, 4.3.4, 4.4.4, 4.5.2, 4.6.2, 4.7.3, 4.8.4, 4.9.2, 5.0.2, 5.1.3, 5.2.4, 5.3.3, 5.4.3, 5.5.4, 5.6.4, 5.7.4, 5.8.3, 5.9.3, 6.0.3, 6.1.4, 6.2.4, 6.3.6, 6.4.5, 6.5.3, 6.6.4, 6.7.3, 6.8.4, 6.9.3, 7.0.4, 7.1.4, 7.2.4, 7.3.4, 7.4.4, 7.5.6, 7.6.3, 7.7.5, 7.8.3, 7.9.3, 8.0.2, 8.1.3, 8.2.5, 8.3.2, 8.4.4, 8.5.2, 8.6.3, 8.7.3, 8.8.4, 8.9.3, 9.0.4, 9.1.2, 9.2.3, 9.3.4, 9.4.3, 9.5.4, 9.6.3, 9.7.2, 9.8.2, 9.9.2, 10.0.1, 10.1.1, 10.2.2, 10.3.1, 10.4.1, 10.5.2, 10.6.2, 10.7.1, 10.8.1, 10.9.2, 11.0.1, 11.1.3, 11.2.1, 11.3.3, 11.4.1, 11.5.2, 11.6.1, 11.7.2, 11.8.5, 11.9.2, 12.0.1, 12.1.1

Timeline

2026-10-02 Threatist record created from CVE-2023-2996
2026-10-03 Alias added: GHSA-qhhp-34vh-xjwv

References

Exploit 1

https://wpscan.com/vulnerability/52d221bd-ae42-435d-a90a-60a5ae530663

Advisory 1

https://jetpack.com/blog/jetpack-12-1-1-critical-security-update/

TI-2024-10066 Jetpack 13.0-14.0 - Unauthenticated DOM-XSS CVSS 3.1MEDIUM 6.1
TI-2024-09340 Jetpack < 13.8, Boost < 3.4.8 - Contributor+ Stored XSS CVSS 3.1MEDIUM 5.9
TI-2024-09339 Jetpack < 13.8 - Unauthenticated Arbitrary Block & Shortcode Execution CVSS 3.1MEDIUM 5.6
TI-2023-30606 Jetpack 11.4 - Cross Site Scripting (XSS) CVSS 4.0MEDIUM 5.1
TI-2023-25898 WordPress Jetpack plugin < 12.7 - Contributor+ Broken Access Control vulnerability CVSS 3.1HIGH 8.8
TI-2011-04017 SQL injection vulnerability in modules/sharedaddy.php in the Jetpack plugin for WordPress… CVSS 2.0HIGH 7.5

See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences