Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2023-2996

Jetpack < 12.1.1 - Author+ Arbitrary File Manipulation via API

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WPScan

Description

The Jetpack WordPress plugin before 12.1.1 does not validate uploaded files, allowing users with author roles or above to manipulate existing files on the site, deleting arbitrary files, and in rare cases achieve Remote Code Execution via phar deserialization.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown Jetpack

Default version status: unaffected

  • 1.9 to < 2.0.9affected
  • 2.1 to < 2.1.7affected
  • 2.2 to < 2.2.10affected
  • 2.3 to < 2.3.10affected
  • 2.4 to < 2.4.7affected
  • 2.5 to < 2.5.5affected
  • 2.6 to < 2.6.6affected
  • 2.7 to < 2.7.5affected
  • 2.8 to < 2.8.5affected
  • 2.9 to < 2.9.6affected
  • 3.0 to < 3.0.6affected
  • 3.1 to < 3.1.5affected
  • 3.2 to < 3.2.5affected
  • 3.3 to < 3.3.6affected
  • 3.4 to < 3.4.6affected
  • 3.5 to < 3.5.6affected
  • 3.6 to < 3.6.4affected
  • 3.7 to < 3.7.5affected
  • 3.8 to < 3.8.5affected
  • 3.9 to < 3.9.9affected
  • 4.0 to < 4.0.6affected
  • 4.1 to < 4.1.3affected
  • 4.2 to < 4.2.4affected
  • 4.3 to < 4.3.4affected
  • 4.4 to < 4.4.4affected
  • 4.5 to < 4.5.2affected
  • 4.6 to < 4.6.2affected
  • 4.7 to < 4.7.3affected
  • 4.8 to < 4.8.4affected
  • 4.9 to < 4.9.2affected
  • 5.0 to < 5.0.2affected
  • 5.1 to < 5.1.3affected
  • 5.2 to < 5.2.4affected
  • 5.3 to < 5.3.3affected
  • 5.4 to < 5.4.3affected
  • 5.5 to < 5.5.4affected
  • 5.6 to < 5.6.4affected
  • 5.7 to < 5.7.4affected
  • 5.8 to < 5.8.3affected
  • 5.9 to < 5.9.3affected
  • 6.0 to < 6.0.3affected
  • 6.1 to < 6.1.4affected
  • 6.2 to < 6.2.4affected
  • 6.3 to < 6.3.6affected
  • 6.4 to < 6.4.5affected
  • 6.5 to < 6.5.3affected
  • 6.6 to < 6.6.4affected
  • 6.7 to < 6.7.3affected
  • 6.8 to < 6.8.4affected
  • 6.9 to < 6.9.3affected
  • 7.0 to < 7.0.4affected
  • 7.1 to < 7.1.4affected
  • 7.2 to < 7.2.4affected
  • 7.3 to < 7.3.4affected
  • 7.4 to < 7.4.4affected
  • 7.5 to < 7.5.6affected
  • 7.6 to < 7.6.3affected
  • 7.7 to < 7.7.5affected
  • 7.8 to < 7.8.3affected
  • 7.9 to < 7.9.3affected
  • 8.0 to < 8.0.2affected
  • 8.1 to < 8.1.3affected
  • 8.2 to < 8.2.5affected
  • 8.3 to < 8.3.2affected
  • 8.4 to < 8.4.4affected
  • 8.5 to < 8.5.2affected
  • 8.6 to < 8.6.3affected
  • 8.7 to < 8.7.3affected
  • 8.8 to < 8.8.4affected
  • 8.9 to < 8.9.3affected
  • 9.0 to < 9.0.4affected
  • 9.1 to < 9.1.2affected
  • 9.2 to < 9.2.3affected
  • 9.3 to < 9.3.4affected
  • 9.4 to < 9.4.3affected
  • 9.5 to < 9.5.4affected
  • 9.6 to < 9.6.3affected
  • 9.7 to < 9.7.2affected
  • 9.8 to < 9.8.2affected
  • 9.9 to < 9.9.2affected
  • 10.0 to < 10.0.1affected
  • 10.1 to < 10.1.1affected
  • 10.2 to < 10.2.2affected
  • 10.3 to < 10.3.1affected
  • 10.4 to < 10.4.1affected
  • 10.5 to < 10.5.2affected
  • 10.6 to < 10.6.2affected
  • 10.7 to < 10.7.1affected
  • 10.8 to < 10.8.1affected
  • 10.9 to < 10.9.2affected
  • 11.0 to < 11.0.1affected
  • 11.1 to < 11.1.3affected
  • 11.2 to < 11.2.1affected
  • 11.3 to < 11.3.3affected
  • 11.4 to < 11.4.1affected
  • 11.5 to < 11.5.2affected
  • 11.6 to < 11.6.1affected
  • 11.7 to < 11.7.2affected
  • 11.8 to < 11.8.5affected
  • 11.9 to < 11.9.2affected
  • 12.0 to < 12.0.1affected
  • 12.1 to < 12.1.1affected

References