Jetpack < 13.8 - Unauthenticated Arbitrary Block & Shortcode Execution
Priority MEDIUM 58Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.
Summary
The Jetpack WordPress plugin before 13.8 does not ensure that the post created by the Contact Form is only accessible to authorised users, which could allow unauthenticated users to run arbitrary shortcodes and block.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00412 35th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed Jetpack (Unknown): 13.8
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Jetpack | before 13.8 | 13.8 | Patch available | CNA |
- Jetpack VendorUnknown Affected before 13.8 Fixed in 13.8 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:automattic:jetpack:*:*:*:*:*:wordpress:*:* | before 13.8 | Vulnerable | Automattic |
- cpe:2.3:a:automattic:jetpack:*:*:*:*:*:wordpress:*:* Versions before 13.8 Vulnerable ·Automattic
Remediation
- Fix · CNA Jetpack (Unknown) Fixed in 13.8
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Jetpack 13.8
2 records Highest priority Priority MEDIUM 2 MEDIUM
Other records, highest priority first
- TI-2024-09340 Jetpack < 13.8, Boost < 3.4.8 - Contributor+ Stored XSSPriority MEDIUM 60
Timeline
- 2026-10-02 Threatist record created from CVE-2024-10075
- 2026-10-03 Alias added: GHSA-cg9w-78cc-f78x
References
More Automattic Jetpack vulnerabilities
- TI-2023-02806 Jetpack < 12.1.1 - Author+ Arbitrary File Manipulation via API CVSS 3.1HIGH 8.8
- TI-2024-10066 Jetpack 13.0-14.0 - Unauthenticated DOM-XSS CVSS 3.1MEDIUM 6.1
- TI-2024-09340 Jetpack < 13.8, Boost < 3.4.8 - Contributor+ Stored XSS CVSS 3.1MEDIUM 5.9
- TI-2023-30606 Jetpack 11.4 - Cross Site Scripting (XSS) CVSS 4.0MEDIUM 5.1
- TI-2023-25898 WordPress Jetpack plugin < 12.7 - Contributor+ Broken Access Control vulnerability CVSS 3.1HIGH 8.8
- TI-2011-04017 SQL injection vulnerability in modules/sharedaddy.php in the Jetpack plugin for WordPress… CVSS 2.0HIGH 7.5
Sources
- CVE-2024-10075 · CVE Program
- CVE-2024-10075 · NVD
- FIRST EPSS
- GHSA-cg9w-78cc-f78x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences