{"id":"CVE-2023-2996","state":"PUBLISHED","title":"Jetpack < 12.1.1 - Author+ Arbitrary File Manipulation via API","description":"The Jetpack WordPress plugin before 12.1.1 does not validate uploaded files, allowing users with author roles or above to manipulate existing files on the site, deleting arbitrary files, and in rare cases achieve Remote Code Execution via phar deserialization.","publishedAt":"2023-06-27T13:17:07.479Z","updatedAt":"2024-12-05T16:48:09.882Z","severity":null,"assigner":"WPScan","products":["Unknown Jetpack"],"affected":[{"vendor":"Unknown","product":"Jetpack","defaultStatus":"unaffected","versions":[{"version":"1.9","status":"affected","lessThan":"2.0.9","versionType":"custom"},{"version":"2.1","status":"affected","lessThan":"2.1.7","versionType":"custom"},{"version":"2.2","status":"affected","lessThan":"2.2.10","versionType":"custom"},{"version":"2.3","status":"affected","lessThan":"2.3.10","versionType":"custom"},{"version":"2.4","status":"affected","lessThan":"2.4.7","versionType":"custom"},{"version":"2.5","status":"affected","lessThan":"2.5.5","versionType":"custom"},{"version":"2.6","status":"affected","lessThan":"2.6.6","versionType":"custom"},{"version":"2.7","status":"affected","lessThan":"2.7.5","versionType":"custom"},{"version":"2.8","status":"affected","lessThan":"2.8.5","versionType":"custom"},{"version":"2.9","status":"affected","lessThan":"2.9.6","versionType":"custom"},{"version":"3.0","status":"affected","lessThan":"3.0.6","versionType":"custom"},{"version":"3.1","status":"affected","lessThan":"3.1.5","versionType":"custom"},{"version":"3.2","status":"affected","lessThan":"3.2.5","versionType":"custom"},{"version":"3.3","status":"affected","lessThan":"3.3.6","versionType":"custom"},{"version":"3.4","status":"affected","lessThan":"3.4.6","versionType":"custom"},{"version":"3.5","status":"affected","lessThan":"3.5.6","versionType":"custom"},{"version":"3.6","status":"affected","lessThan":"3.6.4","versionType":"custom"},{"version":"3.7","status":"affected","lessThan":"3.7.5","versionType":"custom"},{"version":"3.8","status":"affected","lessThan":"3.8.5","versionType":"custom"},{"version":"3.9","status":"affected","lessThan":"3.9.9","versionType":"custom"},{"version":"4.0","status":"affected","lessThan":"4.0.6","versionType":"custom"},{"version":"4.1","status":"affected","lessThan":"4.1.3","versionType":"custom"},{"version":"4.2","status":"affected","lessThan":"4.2.4","versionType":"custom"},{"version":"4.3","status":"affected","lessThan":"4.3.4","versionType":"custom"},{"version":"4.4","status":"affected","lessThan":"4.4.4","versionType":"custom"},{"version":"4.5","status":"affected","lessThan":"4.5.2","versionType":"custom"},{"version":"4.6","status":"affected","lessThan":"4.6.2","versionType":"custom"},{"version":"4.7","status":"affected","lessThan":"4.7.3","versionType":"custom"},{"version":"4.8","status":"affected","lessThan":"4.8.4","versionType":"custom"},{"version":"4.9","status":"affected","lessThan":"4.9.2","versionType":"custom"},{"version":"5.0","status":"affected","lessThan":"5.0.2","versionType":"custom"},{"version":"5.1","status":"affected","lessThan":"5.1.3","versionType":"custom"},{"version":"5.2","status":"affected","lessThan":"5.2.4","versionType":"custom"},{"version":"5.3","status":"affected","lessThan":"5.3.3","versionType":"custom"},{"version":"5.4","status":"affected","lessThan":"5.4.3","versionType":"custom"},{"version":"5.5","status":"affected","lessThan":"5.5.4","versionType":"custom"},{"version":"5.6","status":"affected","lessThan":"5.6.4","versionType":"custom"},{"version":"5.7","status":"affected","lessThan":"5.7.4","versionType":"custom"},{"version":"5.8","status":"affected","lessThan":"5.8.3","versionType":"custom"},{"version":"5.9","status":"affected","lessThan":"5.9.3","versionType":"custom"},{"version":"6.0","status":"affected","lessThan":"6.0.3","versionType":"custom"},{"version":"6.1","status":"affected","lessThan":"6.1.4","versionType":"custom"},{"version":"6.2","status":"affected","lessThan":"6.2.4","versionType":"custom"},{"version":"6.3","status":"affected","lessThan":"6.3.6","versionType":"custom"},{"version":"6.4","status":"affected","lessThan":"6.4.5","versionType":"custom"},{"version":"6.5","status":"affected","lessThan":"6.5.3","versionType":"custom"},{"version":"6.6","status":"affected","lessThan":"6.6.4","versionType":"custom"},{"version":"6.7","status":"affected","lessThan":"6.7.3","versionType":"custom"},{"version":"6.8","status":"affected","lessThan":"6.8.4","versionType":"custom"},{"version":"6.9","status":"affected","lessThan":"6.9.3","versionType":"custom"},{"version":"7.0","status":"affected","lessThan":"7.0.4","versionType":"custom"},{"version":"7.1","status":"affected","lessThan":"7.1.4","versionType":"custom"},{"version":"7.2","status":"affected","lessThan":"7.2.4","versionType":"custom"},{"version":"7.3","status":"affected","lessThan":"7.3.4","versionType":"custom"},{"version":"7.4","status":"affected","lessThan":"7.4.4","versionType":"custom"},{"version":"7.5","status":"affected","lessThan":"7.5.6","versionType":"custom"},{"version":"7.6","status":"affected","lessThan":"7.6.3","versionType":"custom"},{"version":"7.7","status":"affected","lessThan":"7.7.5","versionType":"custom"},{"version":"7.8","status":"affected","lessThan":"7.8.3","versionType":"custom"},{"version":"7.9","status":"affected","lessThan":"7.9.3","versionType":"custom"},{"version":"8.0","status":"affected","lessThan":"8.0.2","versionType":"custom"},{"version":"8.1","status":"affected","lessThan":"8.1.3","versionType":"custom"},{"version":"8.2","status":"affected","lessThan":"8.2.5","versionType":"custom"},{"version":"8.3","status":"affected","lessThan":"8.3.2","versionType":"custom"},{"version":"8.4","status":"affected","lessThan":"8.4.4","versionType":"custom"},{"version":"8.5","status":"affected","lessThan":"8.5.2","versionType":"custom"},{"version":"8.6","status":"affected","lessThan":"8.6.3","versionType":"custom"},{"version":"8.7","status":"affected","lessThan":"8.7.3","versionType":"custom"},{"version":"8.8","status":"affected","lessThan":"8.8.4","versionType":"custom"},{"version":"8.9","status":"affected","lessThan":"8.9.3","versionType":"custom"},{"version":"9.0","status":"affected","lessThan":"9.0.4","versionType":"custom"},{"version":"9.1","status":"affected","lessThan":"9.1.2","versionType":"custom"},{"version":"9.2","status":"affected","lessThan":"9.2.3","versionType":"custom"},{"version":"9.3","status":"affected","lessThan":"9.3.4","versionType":"custom"},{"version":"9.4","status":"affected","lessThan":"9.4.3","versionType":"custom"},{"version":"9.5","status":"affected","lessThan":"9.5.4","versionType":"custom"},{"version":"9.6","status":"affected","lessThan":"9.6.3","versionType":"custom"},{"version":"9.7","status":"affected","lessThan":"9.7.2","versionType":"custom"},{"version":"9.8","status":"affected","lessThan":"9.8.2","versionType":"custom"},{"version":"9.9","status":"affected","lessThan":"9.9.2","versionType":"custom"},{"version":"10.0","status":"affected","lessThan":"10.0.1","versionType":"custom"},{"version":"10.1","status":"affected","lessThan":"10.1.1","versionType":"custom"},{"version":"10.2","status":"affected","lessThan":"10.2.2","versionType":"custom"},{"version":"10.3","status":"affected","lessThan":"10.3.1","versionType":"custom"},{"version":"10.4","status":"affected","lessThan":"10.4.1","versionType":"custom"},{"version":"10.5","status":"affected","lessThan":"10.5.2","versionType":"custom"},{"version":"10.6","status":"affected","lessThan":"10.6.2","versionType":"custom"},{"version":"10.7","status":"affected","lessThan":"10.7.1","versionType":"custom"},{"version":"10.8","status":"affected","lessThan":"10.8.1","versionType":"custom"},{"version":"10.9","status":"affected","lessThan":"10.9.2","versionType":"custom"},{"version":"11.0","status":"affected","lessThan":"11.0.1","versionType":"custom"},{"version":"11.1","status":"affected","lessThan":"11.1.3","versionType":"custom"},{"version":"11.2","status":"affected","lessThan":"11.2.1","versionType":"custom"},{"version":"11.3","status":"affected","lessThan":"11.3.3","versionType":"custom"},{"version":"11.4","status":"affected","lessThan":"11.4.1","versionType":"custom"},{"version":"11.5","status":"affected","lessThan":"11.5.2","versionType":"custom"},{"version":"11.6","status":"affected","lessThan":"11.6.1","versionType":"custom"},{"version":"11.7","status":"affected","lessThan":"11.7.2","versionType":"custom"},{"version":"11.8","status":"affected","lessThan":"11.8.5","versionType":"custom"},{"version":"11.9","status":"affected","lessThan":"11.9.2","versionType":"custom"},{"version":"12.0","status":"affected","lessThan":"12.0.1","versionType":"custom"},{"version":"12.1","status":"affected","lessThan":"12.1.1","versionType":"custom"}],"collectionURL":"https://wordpress.org/plugins"}],"references":["https://wpscan.com/vulnerability/52d221bd-ae42-435d-a90a-60a5ae530663","https://jetpack.com/blog/jetpack-12-1-1-critical-security-update/"],"weaknesses":[],"ingestedAt":"2026-10-29T20:05:52.290Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/2xxx/CVE-2023-2996.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-2996","state":"PUBLISHED","datePublished":"2023-06-27T13:17:07.479Z","dateUpdated":"2024-12-05T16:48:09.882Z","assignerShortName":"WPScan","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateReserved":"2023-05-30T19:10:08.911Z"},"containers":{"cna":{"title":"Jetpack < 12.1.1 - Author+ Arbitrary File Manipulation via API","descriptions":[{"lang":"en","value":"The Jetpack WordPress plugin before 12.1.1 does not validate uploaded files, allowing users with author roles or above to manipulate existing files on the site, deleting arbitrary files, and in rare cases achieve Remote Code Execution via phar deserialization."}],"affected":[{"vendor":"Unknown","product":"Jetpack","defaultStatus":"unaffected","versions":[{"version":"1.9","status":"affected","lessThan":"2.0.9","versionType":"custom"},{"version":"2.1","status":"affected","lessThan":"2.1.7","versionType":"custom"},{"version":"2.2","status":"affected","lessThan":"2.2.10","versionType":"custom"},{"version":"2.3","status":"affected","lessThan":"2.3.10","versionType":"custom"},{"version":"2.4","status":"affected","lessThan":"2.4.7","versionType":"custom"},{"version":"2.5","status":"affected","lessThan":"2.5.5","versionType":"custom"},{"version":"2.6","status":"affected","lessThan":"2.6.6","versionType":"custom"},{"version":"2.7","status":"affected","lessThan":"2.7.5","versionType":"custom"},{"version":"2.8","status":"affected","lessThan":"2.8.5","versionType":"custom"},{"version":"2.9","status":"affected","lessThan":"2.9.6","versionType":"custom"},{"version":"3.0","status":"affected","lessThan":"3.0.6","versionType":"custom"},{"version":"3.1","status":"affected","lessThan":"3.1.5","versionType":"custom"},{"version":"3.2","status":"affected","lessThan":"3.2.5","versionType":"custom"},{"version":"3.3","status":"affected","lessThan":"3.3.6","versionType":"custom"},{"version":"3.4","status":"affected","lessThan":"3.4.6","versionType":"custom"},{"version":"3.5","status":"affected","lessThan":"3.5.6","versionType":"custom"},{"version":"3.6","status":"affected","lessThan":"3.6.4","versionType":"custom"},{"version":"3.7","status":"affected","lessThan":"3.7.5","versionType":"custom"},{"version":"3.8","status":"affected","lessThan":"3.8.5","versionType":"custom"},{"version":"3.9","status":"affected","lessThan":"3.9.9","versionType":"custom"},{"version":"4.0","status":"affected","lessThan":"4.0.6","versionType":"custom"},{"version":"4.1","status":"affected","lessThan":"4.1.3","versionType":"custom"},{"version":"4.2","status":"affected","lessThan":"4.2.4","versionType":"custom"},{"version":"4.3","status":"affected","lessThan":"4.3.4","versionType":"custom"},{"version":"4.4","status":"affected","lessThan":"4.4.4","versionType":"custom"},{"version":"4.5","status":"affected","lessThan":"4.5.2","versionType":"custom"},{"version":"4.6","status":"affected","lessThan":"4.6.2","versionType":"custom"},{"version":"4.7","status":"affected","lessThan":"4.7.3","versionType":"custom"},{"version":"4.8","status":"affected","lessThan":"4.8.4","versionType":"custom"},{"version":"4.9","status":"affected","lessThan":"4.9.2","versionType":"custom"},{"version":"5.0","status":"affected","lessThan":"5.0.2","versionType":"custom"},{"version":"5.1","status":"affected","lessThan":"5.1.3","versionType":"custom"},{"version":"5.2","status":"affected","lessThan":"5.2.4","versionType":"custom"},{"version":"5.3","status":"affected","lessThan":"5.3.3","versionType":"custom"},{"version":"5.4","status":"affected","lessThan":"5.4.3","versionType":"custom"},{"version":"5.5","status":"affected","lessThan":"5.5.4","versionType":"custom"},{"version":"5.6","status":"affected","lessThan":"5.6.4","versionType":"custom"},{"version":"5.7","status":"affected","lessThan":"5.7.4","versionType":"custom"},{"version":"5.8","status":"affected","lessThan":"5.8.3","versionType":"custom"},{"version":"5.9","status":"affected","lessThan":"5.9.3","versionType":"custom"},{"version":"6.0","status":"affected","lessThan":"6.0.3","versionType":"custom"},{"version":"6.1","status":"affected","lessThan":"6.1.4","versionType":"custom"},{"version":"6.2","status":"affected","lessThan":"6.2.4","versionType":"custom"},{"version":"6.3","status":"affected","lessThan":"6.3.6","versionType":"custom"},{"version":"6.4","status":"affected","lessThan":"6.4.5","versionType":"custom"},{"version":"6.5","status":"affected","lessThan":"6.5.3","versionType":"custom"},{"version":"6.6","status":"affected","lessThan":"6.6.4","versionType":"custom"},{"version":"6.7","status":"affected","lessThan":"6.7.3","versionType":"custom"},{"version":"6.8","status":"affected","lessThan":"6.8.4","versionType":"custom"},{"version":"6.9","status":"affected","lessThan":"6.9.3","versionType":"custom"},{"version":"7.0","status":"affected","lessThan":"7.0.4","versionType":"custom"},{"version":"7.1","status":"affected","lessThan":"7.1.4","versionType":"custom"},{"version":"7.2","status":"affected","lessThan":"7.2.4","versionType":"custom"},{"version":"7.3","status":"affected","lessThan":"7.3.4","versionType":"custom"},{"version":"7.4","status":"affected","lessThan":"7.4.4","versionType":"custom"},{"version":"7.5","status":"affected","lessThan":"7.5.6","versionType":"custom"},{"version":"7.6","status":"affected","lessThan":"7.6.3","versionType":"custom"},{"version":"7.7","status":"affected","lessThan":"7.7.5","versionType":"custom"},{"version":"7.8","status":"affected","lessThan":"7.8.3","versionType":"custom"},{"version":"7.9","status":"affected","lessThan":"7.9.3","versionType":"custom"},{"version":"8.0","status":"affected","lessThan":"8.0.2","versionType":"custom"},{"version":"8.1","status":"affected","lessThan":"8.1.3","versionType":"custom"},{"version":"8.2","status":"affected","lessThan":"8.2.5","versionType":"custom"},{"version":"8.3","status":"affected","lessThan":"8.3.2","versionType":"custom"},{"version":"8.4","status":"affected","lessThan":"8.4.4","versionType":"custom"},{"version":"8.5","status":"affected","lessThan":"8.5.2","versionType":"custom"},{"version":"8.6","status":"affected","lessThan":"8.6.3","versionType":"custom"},{"version":"8.7","status":"affected","lessThan":"8.7.3","versionType":"custom"},{"version":"8.8","status":"affected","lessThan":"8.8.4","versionType":"custom"},{"version":"8.9","status":"affected","lessThan":"8.9.3","versionType":"custom"},{"version":"9.0","status":"affected","lessThan":"9.0.4","versionType":"custom"},{"version":"9.1","status":"affected","lessThan":"9.1.2","versionType":"custom"},{"version":"9.2","status":"affected","lessThan":"9.2.3","versionType":"custom"},{"version":"9.3","status":"affected","lessThan":"9.3.4","versionType":"custom"},{"version":"9.4","status":"affected","lessThan":"9.4.3","versionType":"custom"},{"version":"9.5","status":"affected","lessThan":"9.5.4","versionType":"custom"},{"version":"9.6","status":"affected","lessThan":"9.6.3","versionType":"custom"},{"version":"9.7","status":"affected","lessThan":"9.7.2","versionType":"custom"},{"version":"9.8","status":"affected","lessThan":"9.8.2","versionType":"custom"},{"version":"9.9","status":"affected","lessThan":"9.9.2","versionType":"custom"},{"version":"10.0","status":"affected","lessThan":"10.0.1","versionType":"custom"},{"version":"10.1","status":"affected","lessThan":"10.1.1","versionType":"custom"},{"version":"10.2","status":"affected","lessThan":"10.2.2","versionType":"custom"},{"version":"10.3","status":"affected","lessThan":"10.3.1","versionType":"custom"},{"version":"10.4","status":"affected","lessThan":"10.4.1","versionType":"custom"},{"version":"10.5","status":"affected","lessThan":"10.5.2","versionType":"custom"},{"version":"10.6","status":"affected","lessThan":"10.6.2","versionType":"custom"},{"version":"10.7","status":"affected","lessThan":"10.7.1","versionType":"custom"},{"version":"10.8","status":"affected","lessThan":"10.8.1","versionType":"custom"},{"version":"10.9","status":"affected","lessThan":"10.9.2","versionType":"custom"},{"version":"11.0","status":"affected","lessThan":"11.0.1","versionType":"custom"},{"version":"11.1","status":"affected","lessThan":"11.1.3","versionType":"custom"},{"version":"11.2","status":"affected","lessThan":"11.2.1","versionType":"custom"},{"version":"11.3","status":"affected","lessThan":"11.3.3","versionType":"custom"},{"version":"11.4","status":"affected","lessThan":"11.4.1","versionType":"custom"},{"version":"11.5","status":"affected","lessThan":"11.5.2","versionType":"custom"},{"version":"11.6","status":"affected","lessThan":"11.6.1","versionType":"custom"},{"version":"11.7","status":"affected","lessThan":"11.7.2","versionType":"custom"},{"version":"11.8","status":"affected","lessThan":"11.8.5","versionType":"custom"},{"version":"11.9","status":"affected","lessThan":"11.9.2","versionType":"custom"},{"version":"12.0","status":"affected","lessThan":"12.0.1","versionType":"custom"},{"version":"12.1","status":"affected","lessThan":"12.1.1","versionType":"custom"}],"collectionURL":"https://wordpress.org/plugins"}],"references":[{"url":"https://wpscan.com/vulnerability/52d221bd-ae42-435d-a90a-60a5ae530663","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://jetpack.com/blog/jetpack-12-1-1-critical-security-update/","tags":["vendor-advisory"]}],"problemTypes":[{"descriptions":[{"description":"CWE-20 Improper Input Validation","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WPScan","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateUpdated":"2023-06-27T13:17:07.479Z"},"credits":[{"lang":"en","value":"Miguel Neto","type":"finder"},{"lang":"en","value":"WPScan","type":"coordinator"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"WPScan CVE Generator"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://wpscan.com/vulnerability/52d221bd-ae42-435d-a90a-60a5ae530663","tags":["exploit","vdb-entry","technical-description","x_transferred"]},{"url":"https://jetpack.com/blog/jetpack-12-1-1-critical-security-update/","tags":["vendor-advisory","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T06:41:03.950Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-12-05T16:47:57.983039Z","id":"CVE-2023-2996","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-12-05T16:48:09.882Z"}}]}}}