{"id":"CVE-2024-9926","summary":"Jetpack \u003c 13.9.1 - Subscriber+ Arbitrary Feedback Access","details":"The Jetpack WordPress plugin does not have proper authorisation in one of its REST endpoint, allowing any authenticated users, such as subscriber to read arbitrary feedbacks data sent via the Jetpack Contact Form","modified":"2026-08-12T03:51:37.022856763Z","published":"2024-11-07T15:02:38.050Z","database_specific":{"unresolved_ranges":[{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"13.9"},{"fixed":"13.9.1"},{"introduced":"13.8"},{"fixed":"13.8.2"},{"introduced":"13.7"},{"fixed":"13.7.1"},{"introduced":"13.6"},{"fixed":"13.6.1"},{"introduced":"13.5"},{"fixed":"13.5.1"},{"introduced":"13.4"},{"fixed":"13.4.4"},{"introduced":"13.3"},{"fixed":"13.3.2"},{"introduced":"13.2"},{"fixed":"13.2.3"},{"introduced":"13.1"},{"fixed":"13.1.4"},{"introduced":"13.0"},{"fixed":"13.0.1"},{"introduced":"12.9"},{"fixed":"12.9.4"},{"introduced":"12.8"},{"fixed":"12.8.2"},{"introduced":"12.7"},{"fixed":"12.7.2"},{"introduced":"12.6"},{"fixed":"12.6.3"},{"introduced":"12.5"},{"fixed":"12.5.1"},{"introduced":"12.4"},{"fixed":"12.4.1"},{"introduced":"12.3"},{"fixed":"12.3.1"},{"introduced":"12.2"},{"fixed":"12.2.2"},{"introduced":"12.1"},{"fixed":"12.1.2"},{"introduced":"12.0"},{"fixed":"12.0.2"},{"introduced":"11.9"},{"fixed":"11.9.3"},{"introduced":"11.8"},{"fixed":"11.8.6"},{"introduced":"11.7"},{"fixed":"11.7.3"},{"introduced":"11.6"},{"fixed":"11.6.2"},{"introduced":"11.5"},{"fixed":"11.5.3"},{"introduced":"11.4"},{"fixed":"11.4.2"},{"introduced":"11.3"},{"fixed":"11.3.4"},{"introduced":"11.2"},{"fixed":"11.2.2"},{"introduced":"11.1"},{"fixed":"11.1.4"},{"introduced":"11.0"},{"fixed":"11.0.2"},{"introduced":"10.9"},{"fixed":"10.9.3"},{"introduced":"10.8"},{"fixed":"10.8.2"},{"introduced":"10.7"},{"fixed":"10.7.2"},{"introduced":"10.6"},{"fixed":"10.6.2"},{"introduced":"10.5"},{"fixed":"10.5.3"},{"introduced":"10.4"},{"fixed":"10.4.2"},{"introduced":"10.3"},{"fixed":"10.3.2"},{"introduced":"10.2"},{"fixed":"10.2.3"},{"introduced":"10.1"},{"fixed":"10.1.2"},{"introduced":"10.0"},{"fixed":"10.0.2"},{"introduced":"9.9"},{"fixed":"9.9.3"},{"introduced":"9.8"},{"fixed":"9.8.3"},{"introduced":"9.7"},{"fixed":"9.7.3"},{"introduced":"9.6"},{"fixed":"9.6.4"},{"introduced":"9.5"},{"fixed":"9.5.5"},{"introduced":"9.4"},{"fixed":"9.4.4"},{"introduced":"9.3"},{"fixed":"9.3.5"},{"introduced":"9.2"},{"fixed":"9.2.4"},{"introduced":"9.1"},{"fixed":"9.1.3"},{"introduced":"9.0"},{"fixed":"9.0.5"},{"introduced":"8.9"},{"fixed":"8.9.4"},{"introduced":"8.8"},{"fixed":"8.8.5"},{"introduced":"8.7"},{"fixed":"8.7.4"},{"introduced":"8.6"},{"fixed":"8.6.4"},{"introduced":"8.5"},{"fixed":"8.5.3"},{"introduced":"8.4"},{"fixed":"8.4.5"},{"introduced":"8.3"},{"fixed":"8.3.3"},{"introduced":"8.2"},{"fixed":"8.2.6"},{"introduced":"8.1"},{"fixed":"8.1.4"},{"introduced":"8.0"},{"fixed":"8.0.3"},{"introduced":"7.9"},{"fixed":"7.9.4"},{"introduced":"7.8"},{"fixed":"7.8.4"},{"introduced":"7.7"},{"fixed":"7.7.6"},{"introduced":"7.6"},{"fixed":"7.6.4"},{"introduced":"7.5"},{"fixed":"7.5.7"},{"introduced":"7.4"},{"fixed":"7.4.5"},{"introduced":"7.3"},{"fixed":"7.3.5"},{"introduced":"7.2"},{"fixed":"7.2.5"},{"introduced":"7.1"},{"fixed":"7.1.5"},{"introduced":"7.0"},{"fixed":"7.0.5"},{"introduced":"6.9"},{"fixed":"6.9.4"},{"introduced":"6.8"},{"fixed":"6.8.5"},{"introduced":"6.7"},{"fixed":"6.7.4"},{"introduced":"6.6"},{"fixed":"6.6.5"},{"introduced":"6.5"},{"fixed":"6.5.4"},{"introduced":"6.4"},{"fixed":"6.4.6"},{"introduced":"6.3"},{"fixed":"6.3.7"},{"introduced":"6.2"},{"fixed":"6.2.5"},{"introduced":"6.1"},{"fixed":"6.1.5"},{"introduced":"6.0"},{"fixed":"6.0.4"},{"introduced":"5.9"},{"fixed":"5.9.4"},{"introduced":"5.8"},{"fixed":"5.8.4"},{"introduced":"5.7"},{"fixed":"5.7.5"},{"introduced":"5.6"},{"fixed":"5.6.5"},{"introduced":"5.5"},{"fixed":"5.5.5"},{"introduced":"5.4"},{"fixed":"5.4.4"},{"introduced":"5.3"},{"fixed":"5.3.4"},{"introduced":"5.2"},{"fixed":"5.2.5"},{"introduced":"5.1"},{"fixed":"5.1.4"},{"introduced":"5.0"},{"fixed":"5.0.3"},{"introduced":"4.9"},{"fixed":"4.9.3"},{"introduced":"4.8"},{"fixed":"4.8.5"},{"introduced":"4.7"},{"fixed":"4.7.4"},{"introduced":"4.6"},{"fixed":"4.6.3"},{"introduced":"4.5"},{"fixed":"4.5.3"},{"introduced":"4.4"},{"fixed":"4.4.5"},{"introduced":"4.3"},{"fixed":"4.3.5"},{"introduced":"4.2"},{"fixed":"4.2.5"},{"introduced":"4.1.0"},{"fixed":"4.1.4"},{"introduced":"4.0.0"},{"fixed":"4.0.7"},{"introduced":"3.9.2"},{"fixed":"3.9.10"}]}],"cna_assigner":"WPScan","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/9xxx/CVE-2024-9926.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/9xxx/CVE-2024-9926.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-9926"},{"type":"EVIDENCE","url":"https://wpscan.com/vulnerability/669382af-f836-4896-bdcb-5c6a57c99bd9/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/automattic/jetpack","events":[{"introduced":"78627b1118d842f157cc31478efe49b3b2c41128"},{"last_affected":"a9045a78c6dd0b8cbc998737e9da8463b7405e00"}],"database_specific":{"extracted_events":[{"introduced":"13.0"},{"last_affected":"13.0"},{"introduced":"13.5"},{"last_affected":"13.5"},{"introduced":"13.6"},{"last_affected":"13.6"},{"introduced":"13.7"},{"last_affected":"13.7"},{"introduced":"13.9"},{"last_affected":"13.9"}],"source":"CPE_STRING","cpe":["cpe:2.3:a:automattic:jetpack:13.0:*:*:*:*:wordpress:*:*","cpe:2.3:a:automattic:jetpack:13.5:*:*:*:*:wordpress:*:*","cpe:2.3:a:automattic:jetpack:13.6:*:*:*:*:wordpress:*:*","cpe:2.3:a:automattic:jetpack:13.7:*:*:*:*:wordpress:*:*","cpe:2.3:a:automattic:jetpack:13.9:*:*:*:*:wordpress:*:*"]}}],"versions":["13.0","13.5","13.6","13.7","13.9"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-9926.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}]}