WordPress CVEs

Description

The Jetpack WordPress plugin before 12.1.1 does not validate uploaded files, allowing users with author roles or above to manipulate existing files on the site, deleting arbitrary files, and in rare cases achieve Remote Code Execution via phar deserialization.

Affected WordPress components

• Jetpack – WP Security, Backup, Speed, & Growth Plugin · jetpack
  Confirmed match Active
  From 7.4 (including) to 7.4.4 (excluding); From 1.9 (including) to 2.0.9 (excluding); From 2.1 (including) to 2.1.7 (excluding); From 2.2 (including) to 2.2.10 (excluding); From 2.3 (including) to 2.3.10 (excluding); From 2.4 (including) to 2.4.7 (excluding); From 2.5 (including) to 2.5.5 (excluding); From 2.6 (including) to 2.6.6 (excluding); From 2.7 (including) to 2.7.5 (excluding); From 2.8 (including) to 2.8.5 (excluding); From 2.9 (including) to 2.9.6 (excluding); From 3.0 (including) to 3.0.6 (excluding); From 3.1 (including) to 3.1.5 (excluding); From 3.2 (including) to 3.2.5 (excluding); From 3.3 (including) to 3.3.6 (excluding); From 3.4 (including) to 3.4.6 (excluding); From 3.5 (including) to 3.5.6 (excluding); From 3.6 (including) to 3.6.4 (excluding); From 3.7 (including) to 3.7.5 (excluding); From 3.8 (including) to 3.8.5 (excluding); From 3.9 (including) to 3.9.9 (excluding); From 4.0 (including) to 4.0.6 (excluding); From 4.1 (including) to 4.1.3 (excluding); From 4.2 (including) to 4.2.4 (excluding); From 4.3 (including) to 4.3.4 (excluding); From 4.4 (including) to 4.4.4 (excluding); From 4.5 (including) to 4.5.2 (excluding); From 4.6 (including) to 4.6.2 (excluding); From 4.7 (including) to 4.7.3 (excluding); From 4.8 (including) to 4.8.4 (excluding); From 4.9 (including) to 4.9.2 (excluding); From 5.0 (including) to 5.0.2 (excluding); From 5.1 (including) to 5.1.3 (excluding); From 5.2 (including) to 5.2.4 (excluding); From 5.3 (including) to 5.3.3 (excluding); From 5.4 (including) to 5.4.3 (excluding); From 5.5 (including) to 5.5.4 (excluding); From 5.6 (including) to 5.6.4 (excluding); From 5.7 (including) to 5.7.4 (excluding); From 5.8 (including) to 5.8.3 (excluding); From 5.9 (including) to 5.9.3 (excluding); From 6.0 (including) to 6.0.3 (excluding); From 6.1 (including) to 6.1.4 (excluding); From 6.2 (including) to 6.2.4 (excluding); From 6.3 (including) to 6.3.6 (excluding); From 6.4 (including) to 6.4.5 (excluding); From 6.5 (including) to 6.5.3 (excluding); From 6.6 (including) to 6.6.4 (excluding); From 6.7 (including) to 6.7.3 (excluding); From 6.8 (including) to 6.8.4 (excluding); From 6.9 (including) to 6.9.3 (excluding); From 7.0 (including) to 7.0.4 (excluding); From 7.1 (including) to 7.1.4 (excluding); From 7.2 (including) to 7.2.4 (excluding); From 7.3 (including) to 7.3.4 (excluding); From 7.5 (including) to 7.5.6 (excluding); From 7.6 (including) to 7.6.3 (excluding); From 7.7 (including) to 7.7.5 (excluding); From 7.8 (including) to 7.8.3 (excluding); From 7.9 (including) to 7.9.3 (excluding); From 8.0 (including) to 8.0.2 (excluding); From 8.1 (including) to 8.1.3 (excluding); From 8.2 (including) to 8.2.5 (excluding); From 8.3 (including) to 8.3.2 (excluding); From 8.4 (including) to 8.4.4 (excluding); From 8.5 (including) to 8.5.2 (excluding); From 8.6 (including) to 8.6.3 (excluding); From 8.7 (including) to 8.7.3 (excluding); From 8.8 (including) to 8.8.4 (excluding); From 8.9 (including) to 8.9.3 (excluding); From 9.0 (including) to 9.0.4 (excluding); From 9.1 (including) to 9.1.2 (excluding); From 9.2 (including) to 9.2.3 (excluding); From 9.3 (including) to 9.3.4 (excluding); From 9.4 (including) to 9.4.3 (excluding); From 9.5 (including) to 9.5.4 (excluding); From 9.6 (including) to 9.6.3 (excluding); From 9.7 (including) to 9.7.2 (excluding); From 9.8 (including) to 9.8.2 (excluding); From 9.9 (including) to 9.9.2 (excluding); From 10.0 (including) to 10.0.1 (excluding); From 10.1 (including) to 10.1.1 (excluding); From 10.2 (including) to 10.2.2 (excluding); From 10.3 (including) to 10.3.1 (excluding); From 10.4 (including) to 10.4.1 (excluding); From 10.5 (including) to 10.5.2 (excluding); From 10.6 (including) to 10.6.2 (excluding); From 10.7 (including) to 10.7.1 (excluding); From 10.8 (including) to 10.8.1 (excluding); From 10.9 (including) to 10.9.2 (excluding); From 11.0 (including) to 11.0.1 (excluding); From 11.1 (including) to 11.1.3 (excluding); From 11.2 (including) to 11.2.1 (excluding); From 11.3 (including) to 11.3.3 (excluding); From 11.4 (including) to 11.4.1 (excluding); From 11.5 (including) to 11.5.2 (excluding); From 11.6 (including) to 11.6.1 (excluding); From 11.7 (including) to 11.7.2 (excluding); From 11.8 (including) to 11.8.5 (excluding); From 11.9 (including) to 11.9.2 (excluding); From 12.0 (including) to 12.0.1 (excluding); From 12.1 (including) to 12.1.1 (excluding); Before 12.1.1
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• Unknown Jetpack — From 1.9 (including) to 2.0.9 (excluding)
• Unknown Jetpack — From 2.1 (including) to 2.1.7 (excluding)
• Unknown Jetpack — From 2.2 (including) to 2.2.10 (excluding)
• Unknown Jetpack — From 2.3 (including) to 2.3.10 (excluding)
• Unknown Jetpack — From 2.4 (including) to 2.4.7 (excluding)
• Unknown Jetpack — From 2.5 (including) to 2.5.5 (excluding)
• Unknown Jetpack — From 2.6 (including) to 2.6.6 (excluding)
• Unknown Jetpack — From 2.7 (including) to 2.7.5 (excluding)
• Unknown Jetpack — From 2.8 (including) to 2.8.5 (excluding)
• Unknown Jetpack — From 2.9 (including) to 2.9.6 (excluding)
• Unknown Jetpack — From 3.0 (including) to 3.0.6 (excluding)
• Unknown Jetpack — From 3.1 (including) to 3.1.5 (excluding)
• Unknown Jetpack — From 3.2 (including) to 3.2.5 (excluding)
• Unknown Jetpack — From 3.3 (including) to 3.3.6 (excluding)
• Unknown Jetpack — From 3.4 (including) to 3.4.6 (excluding)
• Unknown Jetpack — From 3.5 (including) to 3.5.6 (excluding)
• Unknown Jetpack — From 3.6 (including) to 3.6.4 (excluding)
• Unknown Jetpack — From 3.7 (including) to 3.7.5 (excluding)
• Unknown Jetpack — From 3.8 (including) to 3.8.5 (excluding)
• Unknown Jetpack — From 3.9 (including) to 3.9.9 (excluding)
• Unknown Jetpack — From 4.0 (including) to 4.0.6 (excluding)
• Unknown Jetpack — From 4.1 (including) to 4.1.3 (excluding)
• Unknown Jetpack — From 4.2 (including) to 4.2.4 (excluding)
• Unknown Jetpack — From 4.3 (including) to 4.3.4 (excluding)
• Unknown Jetpack — From 4.4 (including) to 4.4.4 (excluding)
• Unknown Jetpack — From 4.5 (including) to 4.5.2 (excluding)
• Unknown Jetpack — From 4.6 (including) to 4.6.2 (excluding)
• Unknown Jetpack — From 4.7 (including) to 4.7.3 (excluding)
• Unknown Jetpack — From 4.8 (including) to 4.8.4 (excluding)
• Unknown Jetpack — From 4.9 (including) to 4.9.2 (excluding)
• Unknown Jetpack — From 5.0 (including) to 5.0.2 (excluding)
• Unknown Jetpack — From 5.1 (including) to 5.1.3 (excluding)
• Unknown Jetpack — From 5.2 (including) to 5.2.4 (excluding)
• Unknown Jetpack — From 5.3 (including) to 5.3.3 (excluding)
• Unknown Jetpack — From 5.4 (including) to 5.4.3 (excluding)
• Unknown Jetpack — From 5.5 (including) to 5.5.4 (excluding)
• Unknown Jetpack — From 5.6 (including) to 5.6.4 (excluding)
• Unknown Jetpack — From 5.7 (including) to 5.7.4 (excluding)
• Unknown Jetpack — From 5.8 (including) to 5.8.3 (excluding)
• Unknown Jetpack — From 5.9 (including) to 5.9.3 (excluding)
• Unknown Jetpack — From 6.0 (including) to 6.0.3 (excluding)
• Unknown Jetpack — From 6.1 (including) to 6.1.4 (excluding)
• Unknown Jetpack — From 6.2 (including) to 6.2.4 (excluding)
• Unknown Jetpack — From 6.3 (including) to 6.3.6 (excluding)
• Unknown Jetpack — From 6.4 (including) to 6.4.5 (excluding)
• Unknown Jetpack — From 6.5 (including) to 6.5.3 (excluding)
• Unknown Jetpack — From 6.6 (including) to 6.6.4 (excluding)
• Unknown Jetpack — From 6.7 (including) to 6.7.3 (excluding)
• Unknown Jetpack — From 6.8 (including) to 6.8.4 (excluding)
• Unknown Jetpack — From 6.9 (including) to 6.9.3 (excluding)
• Unknown Jetpack — From 7.0 (including) to 7.0.4 (excluding)
• Unknown Jetpack — From 7.1 (including) to 7.1.4 (excluding)
• Unknown Jetpack — From 7.2 (including) to 7.2.4 (excluding)
• Unknown Jetpack — From 7.3 (including) to 7.3.4 (excluding)
• Unknown Jetpack — From 7.4 (including) to 7.4.4 (excluding)
• Unknown Jetpack — From 7.5 (including) to 7.5.6 (excluding)
• Unknown Jetpack — From 7.6 (including) to 7.6.3 (excluding)
• Unknown Jetpack — From 7.7 (including) to 7.7.5 (excluding)
• Unknown Jetpack — From 7.8 (including) to 7.8.3 (excluding)
• Unknown Jetpack — From 7.9 (including) to 7.9.3 (excluding)
• Unknown Jetpack — From 8.0 (including) to 8.0.2 (excluding)
• Unknown Jetpack — From 8.1 (including) to 8.1.3 (excluding)
• Unknown Jetpack — From 8.2 (including) to 8.2.5 (excluding)
• Unknown Jetpack — From 8.3 (including) to 8.3.2 (excluding)
• Unknown Jetpack — From 8.4 (including) to 8.4.4 (excluding)
• Unknown Jetpack — From 8.5 (including) to 8.5.2 (excluding)
• Unknown Jetpack — From 8.6 (including) to 8.6.3 (excluding)
• Unknown Jetpack — From 8.7 (including) to 8.7.3 (excluding)
• Unknown Jetpack — From 8.8 (including) to 8.8.4 (excluding)
• Unknown Jetpack — From 8.9 (including) to 8.9.3 (excluding)
• Unknown Jetpack — From 9.0 (including) to 9.0.4 (excluding)
• Unknown Jetpack — From 9.1 (including) to 9.1.2 (excluding)
• Unknown Jetpack — From 9.2 (including) to 9.2.3 (excluding)
• Unknown Jetpack — From 9.3 (including) to 9.3.4 (excluding)
• Unknown Jetpack — From 9.4 (including) to 9.4.3 (excluding)
• Unknown Jetpack — From 9.5 (including) to 9.5.4 (excluding)
• Unknown Jetpack — From 9.6 (including) to 9.6.3 (excluding)
• Unknown Jetpack — From 9.7 (including) to 9.7.2 (excluding)
• Unknown Jetpack — From 9.8 (including) to 9.8.2 (excluding)
• Unknown Jetpack — From 9.9 (including) to 9.9.2 (excluding)
• Unknown Jetpack — From 10.0 (including) to 10.0.1 (excluding)
• Unknown Jetpack — From 10.1 (including) to 10.1.1 (excluding)
• Unknown Jetpack — From 10.2 (including) to 10.2.2 (excluding)
• Unknown Jetpack — From 10.3 (including) to 10.3.1 (excluding)
• Unknown Jetpack — From 10.4 (including) to 10.4.1 (excluding)
• Unknown Jetpack — From 10.5 (including) to 10.5.2 (excluding)
• Unknown Jetpack — From 10.6 (including) to 10.6.2 (excluding)
• Unknown Jetpack — From 10.7 (including) to 10.7.1 (excluding)
• Unknown Jetpack — From 10.8 (including) to 10.8.1 (excluding)
• Unknown Jetpack — From 10.9 (including) to 10.9.2 (excluding)
• Unknown Jetpack — From 11.0 (including) to 11.0.1 (excluding)
• Unknown Jetpack — From 11.1 (including) to 11.1.3 (excluding)
• Unknown Jetpack — From 11.2 (including) to 11.2.1 (excluding)
• Unknown Jetpack — From 11.3 (including) to 11.3.3 (excluding)
• Unknown Jetpack — From 11.4 (including) to 11.4.1 (excluding)
• Unknown Jetpack — From 11.5 (including) to 11.5.2 (excluding)
• Unknown Jetpack — From 11.6 (including) to 11.6.1 (excluding)
• Unknown Jetpack — From 11.7 (including) to 11.7.2 (excluding)
• Unknown Jetpack — From 11.8 (including) to 11.8.5 (excluding)
• Unknown Jetpack — From 11.9 (including) to 11.9.2 (excluding)
• Unknown Jetpack — From 12.0 (including) to 12.0.1 (excluding)
• Unknown Jetpack — From 12.1 (including) to 12.1.1 (excluding)
• automattic jetpack — Before 12.1.1

References

• jetpack.com https://jetpack.com/blog/jetpack-12-1-1-critical-security-update/ Vendor Advisory
• wpscan.com https://wpscan.com/vulnerability/52d221bd-ae42-435d-a90a-60a5ae530663 Exploit, Third Party Advisory
• nvd.nist.gov Official NVD record