4.3 Medium

CVE-2024-9926 The Jetpack WordPress plugin does not have proper authorisation in one of its REST endpoint, allowing any…

Description

The Jetpack WordPress plugin does not have proper authorisation in one of its REST endpoint, allowing any authenticated users, such as subscriber to read arbitrary feedbacks data sent via the Jetpack Contact Form

Affected products and versions

Product	Affected versions	Fixed in
Jetpack 3.9	3.9.2 → < 3.9.10	3.9.10
Jetpack 13.9	13.9 → < 13.9.1	13.9.1
Jetpack 13.8	13.8 → < 13.8.2	13.8.2
Jetpack 13.7	13.7 → < 13.7.1	13.7.1
Jetpack 13.6	13.6 → < 13.6.1	13.6.1
Jetpack 13.5	13.5 → < 13.5.1	13.5.1
Jetpack 13.4	13.4 → < 13.4.4	13.4.4
Jetpack 13.3	13.3 → < 13.3.2	13.3.2
Jetpack 13.2	13.2 → < 13.2.3	13.2.3

Show the 93 other branches

Product	Affected versions	Fixed in
Jetpack 13.1	13.1 → < 13.1.4	13.1.4
Jetpack 13.0	13.0 → < 13.0.1	13.0.1
Jetpack 12.9	12.9 → < 12.9.4	12.9.4
Jetpack 12.8	12.8 → < 12.8.2	12.8.2
Jetpack 12.7	12.7 → < 12.7.2	12.7.2
Jetpack 12.6	12.6 → < 12.6.3	12.6.3
Jetpack 12.5	12.5 → < 12.5.1	12.5.1
Jetpack 12.4	12.4 → < 12.4.1	12.4.1
Jetpack 12.3	12.3 → < 12.3.1	12.3.1
Jetpack 12.2	12.2 → < 12.2.2	12.2.2
Jetpack 12.1	12.1 → < 12.1.2	12.1.2
Jetpack 12.0	12.0 → < 12.0.2	12.0.2
Jetpack 11.9	11.9 → < 11.9.3	11.9.3
Jetpack 11.8	11.8 → < 11.8.6	11.8.6
Jetpack 11.7	11.7 → < 11.7.3	11.7.3
Jetpack 11.6	11.6 → < 11.6.2	11.6.2
Jetpack 11.5	11.5 → < 11.5.3	11.5.3
Jetpack 11.4	11.4 → < 11.4.2	11.4.2
Jetpack 11.3	11.3 → < 11.3.4	11.3.4
Jetpack 11.2	11.2 → < 11.2.2	11.2.2
Jetpack 11.1	11.1 → < 11.1.4	11.1.4
Jetpack 11.0	11.0 → < 11.0.2	11.0.2
Jetpack 10.9	10.9 → < 10.9.3	10.9.3
Jetpack 10.8	10.8 → < 10.8.2	10.8.2
Jetpack 10.7	10.7 → < 10.7.2	10.7.2
Jetpack 10.6	10.6 → < 10.6.2	10.6.2
Jetpack 10.5	10.5 → < 10.5.3	10.5.3
Jetpack 10.4	10.4 → < 10.4.2	10.4.2
Jetpack 10.3	10.3 → < 10.3.2	10.3.2
Jetpack 10.2	10.2 → < 10.2.3	10.2.3
Jetpack 10.1	10.1 → < 10.1.2	10.1.2
Jetpack 10.0	10.0 → < 10.0.2	10.0.2
Jetpack 9.9	9.9 → < 9.9.3	9.9.3
Jetpack 9.8	9.8 → < 9.8.3	9.8.3
Jetpack 9.7	9.7 → < 9.7.3	9.7.3
Jetpack 9.6	9.6 → < 9.6.4	9.6.4
Jetpack 9.5	9.5 → < 9.5.5	9.5.5
Jetpack 9.4	9.4 → 9.4.4	No fix stated
Jetpack 9.3	9.3 → < 9.3.5	9.3.5
Jetpack 9.2	9.2 → < 9.2.4	9.2.4
Jetpack 9.1	9.1 → < 9.1.3	9.1.3
Jetpack 9.0	9.0 → < 9.0.5	9.0.5
Jetpack 8.9	8.9 → < 8.9.4	8.9.4
Jetpack 8.8	8.8 → < 8.8.5	8.8.5
Jetpack 8.7	8.7 → < 8.7.4	8.7.4
Jetpack 8.6	8.6 → < 8.6.4	8.6.4
Jetpack 8.5	8.5 → < 8.5.3	8.5.3
Jetpack 8.4	8.4 → < 8.4.5	8.4.5
Jetpack 8.3	8.3 → < 8.3.3	8.3.3
Jetpack 8.2	8.2 → < 8.2.6	8.2.6
Jetpack 8.1	8.1 → < 8.1.4	8.1.4
Jetpack 8.0	8.0 → < 8.0.3	8.0.3
Jetpack 7.9	7.9 → < 7.9.4	7.9.4
Jetpack 7.8	7.8 → < 7.8.4	7.8.4
Jetpack 7.7	7.7 → < 7.7.6	7.7.6
Jetpack 7.6	7.6 → < 7.6.4	7.6.4
Jetpack 7.5	7.5 → < 7.5.7	7.5.7
Jetpack 7.4	7.4 → < 7.4.5	7.4.5
Jetpack 7.3	7.3 → < 7.3.5	7.3.5
Jetpack 7.2	7.2 → < 7.2.5	7.2.5
Jetpack 7.1	7.1 → < 7.1.5	7.1.5
Jetpack 7.0	7.0 → < 7.0.5	7.0.5
Jetpack 6.9	6.9 → < 6.9.4	6.9.4
Jetpack 6.8	6.8 → < 6.8.5	6.8.5
Jetpack 6.7	6.7 → < 6.7.4	6.7.4
Jetpack 6.6	6.6 → < 6.6.5	6.6.5
Jetpack 6.5	6.5 → < 6.5.4	6.5.4
Jetpack 6.4	6.4 → < 6.4.6	6.4.6
Jetpack 6.3	6.3 → < 6.3.7	6.3.7
Jetpack 6.2	6.2 → < 6.2.5	6.2.5
Jetpack 6.1	6.1 → < 6.1.5	6.1.5
Jetpack 6.0	6.0 → < 6.0.4	6.0.4
Jetpack 5.9	5.9 → < 5.9.4	5.9.4
Jetpack 5.8	5.8 → < 5.8.4	5.8.4
Jetpack 5.7	5.7 → < 5.7.5	5.7.5
Jetpack 5.6	5.6 → < 5.6.5	5.6.5
Jetpack 5.5	5.5 → < 5.5.5	5.5.5
Jetpack 5.4	5.4 → < 5.4.4	5.4.4
Jetpack 5.3	5.3 → < 5.3.4	5.3.4
Jetpack 5.2	5.2 → < 5.2.5	5.2.5
Jetpack 5.1	5.1 → < 5.1.4	5.1.4
Jetpack 5.0	5.0 → < 5.0.3	5.0.3
Jetpack 4.9	4.9 → < 4.9.3	4.9.3
Jetpack 4.8	4.8 → < 4.8.5	4.8.5
Jetpack 4.7	4.7 → < 4.7.4	4.7.4
Jetpack 4.6	4.6 → < 4.6.3	4.6.3
Jetpack 4.5	4.5 → < 4.5.3	4.5.3
Jetpack 4.4	4.4 → < 4.4.5	4.4.5
Jetpack 4.3	4.3 → < 4.3.5	4.3.5
Jetpack 4.2	4.2 → < 4.2.5	4.2.5
Jetpack 4.1	4.1.0 → < 4.1.4	4.1.4
Jetpack 4.0	4.0.0 → < 4.0.7	4.0.7
Jetpack 3.9	3.9.2 → < 3.9.10	3.9.10