--- title: "Jetpack security vulnerabilities: history and forced patches" description: "Every Jetpack vulnerability since 2020: CVEs, affected versions, 102 then 101 versions patched at once, forced updates and how to protect your site." language: "en" locale: "en-US" type: "article" canonical: "https://www.wp-masquerade.com/jetpack-security-vulnerabilities/" published: "2026-10-12T07:00:00+00:00" modified: "2026-10-29T07:36:29+00:00" translations: en-US: "https://www.wp-masquerade.com/jetpack-security-vulnerabilities/index.md" fr-FR: "https://www.wp-masquerade.com/fr/failles-securite-jetpack/index.md" es-ES: "https://www.wp-masquerade.com/es/vulnerabilidades-jetpack/index.md" de-DE: "https://www.wp-masquerade.com/de/jetpack-sicherheitsluecken/index.md" it-IT: "https://www.wp-masquerade.com/it/vulnerabilita-sicurezza-jetpack/index.md" pt-BR: "https://www.wp-masquerade.com/pt/vulnerabilidades-seguranca-jetpack/index.md" nl-NL: "https://www.wp-masquerade.com/nl/jetpack-kwetsbaarheden-beveiliging/index.md" --- # Jetpack security vulnerabilities: history and forced patches Few severe vulnerabilities, but three waves of fixes across dozens of branches, one of them forced by wordpress.org in 2023: Jetpack's security history up to October 9, 2026. Jetpack is Automattic's "Swiss Army knife" plugin, installed on millions of sites and often permanently connected to WordPress.com. Its security history is instructive: few severe vulnerabilities, but three fixes shipped to dozens of branches at once, one of them forced on every site. Here is what has been found since 2020, what was actually exploitable and how to stay up to date without thinking about it. ## Jetpack in brief Jetpack is published by Automattic, which runs WordPress.com and also develops [WooCommerce](https://www.wp-masquerade.com/woocommerce-security-vulnerabilities/). The plugin's wordpress.org page, added to the directory in January 2011, shows more than 3 million active installations. It bundles dozens of modules: stats, contact forms, Carousel galleries, VideoPress videos, social sharing, newsletter, image accelerator, but also security features ([brute force](https://www.wp-masquerade.com/glossary/brute-force-attack/) protection, WordPress.com login) and access to the paid backup and scanning plans. This breadth explains the interest it draws from researchers: every module adds shortcodes, blocks, REST API routes and exchanges with WordPress.com servers. A vulnerability in Jetpack potentially affects millions of sites, an ideal target for a mass attack. ## Timeline of Jetpack vulnerabilities Before 2020, two episodes set the pattern. On April 10, 2014, Jetpack 2.9.3 fixed an access control bypass (CVE-2014-0173) present since version 1.9; the WordPress security team pushed the fix to every affected branch through the core automatic update system. In May 2016, Jetpack 4.0.3 fixed a stored [XSS](https://www.wp-masquerade.com/glossary/xss/) in shortcodes, reported by Marc-Alexandre Montpas (Sucuri) and present since version 2.0; according to a Jetpack developer quoted by WP Tavern, nearly 3 million sites were updated automatically in about twelve hours. ![Timeline of Jetpack vulnerabilities: April 10, 2014 version 2.9.3, May 26, 2016 version 4.0.3, June 1, 2021 version 9.8, May 30, 2023 version 12.1.1 with 102 fixed versions and a forced update, November 15, 2023 version 12.7, May 13, 2024 version 13.4, September 4, 2024 version 13.8, October 14, 2024 version 13.9.1 with 101 fixed versions, December 4, 2024 version 14.1, September 1, 2026 version 16.1.3 with 42 fixed versions, October 7, 2026 version 16.3](https://www.wp-masquerade.com/media/2026/10/chronologie-failles-jetpack-en.webp) *Jetpack's notable vulnerabilities from 2014 to October 9, 2026, with their severity level.* The table below covers the significant vulnerabilities published since 2020: rated high, exploitable without an account, or fixed through a wave of releases. For its three waves of fixes, Jetpack stated it had no evidence of exploitation; for the others, we found no documented attack in the sources consulted (Jetpack, WPScan, Patchstack, Wordfence, CISA's KEV catalog). | Published | Fixed in | Type | CVSS | CVE | Account required | | --- | --- | --- | --- | --- | --- | | June 1, 2021 | 9.8 | Leak of image comments from unpublished content (Carousel) | 5.3 | CVE-2021-24374 | None | | May 30, 2023 | 12.1.1 and 102 versions (affected: 2.0 to 12.1) | File manipulation via the API | 8.8 (Wordfence), 8.0 (WPScan) | CVE-2023-2996 | Author | | November 15, 2023 | 12.7 | Clickjacking via iframe injection | 5.4 | CVE-2023-47774 | Contributor | | November 15, 2023 | 12.8-a.3 (affected: up to 12.8-a.1) | Stored XSS via a block attribute | 6.5 | CVE-2023-45050 | Contributor | | May 13, 2024 | 13.4 | Stored XSS via the wpvideo shortcode | 6.4 | CVE-2024-4392 | Contributor | | September 4, 2024 | 13.8 | Arbitrary block and shortcode execution | 5.6 | CVE-2024-10075 | None | | October 14, 2024 | 13.9.1 and 101 versions (affected: 3.9.9 to 13.9) | Reading contact form submissions | 4.3 | CVE-2024-9926 | Subscriber | | December 4, 2024 | 14.1 (affected: 13.0 to 14.0) | DOM-based XSS, sites hosted on WordPress.com only | 6.1 (CISA), 4.7 (WPScan) | CVE-2024-10858 | None (victim click) | | September 1, 2026 | 16.1.3 and 42 versions (affected: 12.0 to 16.1.2 according to Jetpack) | PHP object injection in the importer | 7.2 (Patchstack) | No CVE published | Administrator or user allowed to import | | September 7, 2026 | 16.1.3 and per-branch fixes (affected: 14.5 to 16.1.2) | Reflected then stored XSS (Reader repost) | 7.1 (WPScan), 6.1 (Patchstack) | No CVE published | None (a logged-in user must click) | | October 7, 2026 | 16.3 | Authentication bypass in Account Protection (two vulnerabilities) | 5.4 and 4.8 | CVE-2026-106601, CVE-2026-106602 | None | *Significant Jetpack vulnerabilities published from January 1, 2020 to October 9, 2026. Dates: first publication by Jetpack, WPScan or Patchstack. CVSS v3.1 from the CVE authority or the database cited, with the source when scores differ.* The other vulnerabilities of the period are minor and require a contributor account: a missing access control on external media REST routes (CVE-2023-47788, November 2023, fixed in 12.7), a stored XSS fixed in 13.2.1 (March 2024) and a stored XSS via the image accelerator, shared by Jetpack and Jetpack Boost (CVE-2024-10076, fixed in 13.8). The September 2026 release also included a missing access control in the WordPress.com Media API ([CVSS](https://www.wp-masquerade.com/glossary/cvss/) 4.3 according to Patchstack). Finally, in 2026, VulnCheck assigned two CVEs to old reflected XSS in the contact form of versions 9.1 and 11.4 (CVE-2022-50958 and CVE-2023-54332). ![Bar chart of Jetpack vulnerabilities per year according to WPScan: none in 2020, 1 medium in 2021, none in 2022, 4 in 2023 including 1 high, 6 medium in 2024, none in 2025, 3 in 2026 including 1 high as of October 9](https://www.wp-masquerade.com/media/2026/10/failles-par-annee-jetpack-en.webp) *14 vulnerabilities listed by WPScan from January 1, 2020 to October 9, 2026, each counted once even when several branches are fixed.* ## The notable vulnerabilities explained ### May 2023: an author could tamper with the site's files (CVE-2023-2996) On May 30, 2023, Jetpack released version 12.1.1, presented as a critical security update. During an internal audit, the team had found a flaw in an API present since version 2.0, released in 2012: a user with the Author role could manipulate any file in the WordPress installation. The CVE record, published by WPScan, specifies that uploaded files were not validated, which made it possible to delete files and, in rare cases, execute code through `phar` deserialization. Wordfence rated the vulnerability 8.8, WPScan 8.0. The response was unusually large: together with the wordpress.org security team, Jetpack released 102 fixed versions the same day, from 2.0.9 to 12.1.1, one per branch. On the support forum, Jeremy Herve (Jetpack) confirmed that this update had overridden individual plugin auto-update settings: wordpress.org updated every site running Jetpack to a safe version. Jetpack said it had no evidence of exploitation. An Author account was enough: on a multi-author site, that is a common access level, hence the value of keeping roles to the strict minimum. ### September 2024: shortcodes executed without an account (CVE-2024-10075) Jetpack 13.8, released on September 4, 2024, fixed a vulnerability found by Marc Montpas (WPScan) in the contact form. According to the CVE record, Jetpack did not check that content created by the form was only accessible to authorized users, which let an anonymous visitor have arbitrary shortcodes and blocks executed. The rating remains medium (5.6): the attack is complex and its impact depends on the site's shortcodes. The same version fixed a stored XSS via the image accelerator, shared with Jetpack Boost. ### October 2024: form submissions readable by any subscriber (CVE-2024-9926) On October 14, 2024, Jetpack released version 13.9.1 and announced that a new internal audit had uncovered a contact form vulnerability present since version 3.9.9 from 2016: any user logged in to the site could read the forms submitted by visitors. Technically, a REST API route lacked an authorization check; a mere Subscriber account was enough. The CVE credits Marc Montpas and WPScan. The CVSS score is modest (4.3), but the exposed data was not: names, email addresses and message contents. On a site with open registration, anyone could create an account and then read that data. Together with the wordpress.org plugins team, Jetpack released 101 fixed versions, from 3.9.10 to 13.9.1, stating that most sites had been or would soon be updated automatically, and that no exploitation was known. See also [our article on REST API security](https://www.wp-masquerade.com/wordpress-rest-api-security/). ### December 2024: an XSS limited to WordPress.com sites (CVE-2024-10858) Reported by researcher Eldar (hakupiku) through WPScan, this vulnerability affected versions 13.0 to 14.0: the origin of `postMessage` messages was not properly checked, which opened a browser-side XSS without an account, provided the victim followed a booby-trapped link. The CVE specifies that it only concerned sites hosted on WordPress.com. Jetpack 14.1, released on December 3, 2024, fixed it. ### September 2026: PHP object injection in the importer, 42 fixed versions Jetpack 16.1.3 came out on September 1, 2026, announced the next day as a critical security update. The main flaw, present according to Jetpack since version 12.0 from 2023, was in the import feature: when restoring the metadata of an imported post, the plugin unserialized that data without restriction. A user allowed to import content could thus make the site build PHP objects, which can lead to other attacks depending on the code present (the mechanism is detailed in [our article on PHP object injection](https://www.wp-masquerade.com/php-deserialization-object-injection/)). Patchstack rates the vulnerability 7.2 and states that an administrator account is required. The same version now checks editing rights before attaching a media item to a post via the Media API, and sanitizes the URL parameters used by the Reader repost feature. That last vulnerability, a reflected XSS that could become stored, affected versions 14.5 to 16.1.2; WPScan rates it 7.1. Jetpack released 42 versions, from 12.0.3 to 16.1.3, with the wordpress.org plugins team, and states that affected sites were updated automatically, with no evidence of exploitation. ### October 2026: Account Protection bypassed (CVE-2026-106601 and CVE-2026-106602) The latest vulnerabilities published before this article target Account Protection, the Jetpack feature that adds a code verification to certain logins. Reported to Patchstack on August 20, 2026 by Ananda Dhakal and published on October 7, they allowed this verification to be bypassed without an account: by brute-forcing the verification code (CVSS 4.8) and through an incorrect capability check on multisite (CVSS 5.4), according to the WPScan titles. The attack complexity is high, hence the medium ratings. Jetpack 16.3, of October 6, 2026, fixes them; its changelog mentions improved login verification in Account Protection. ## What Jetpack's history shows - **Internal audits find the broadest vulnerabilities.** The three waves of fixes in 2023, 2024 and 2026 came from audits run by Automattic, not from observed attacks. - **Old flaws.** The 2023 vulnerability dated back to 2012, the 2024 one to 2016, the 2026 one to 2023. A feature-rich plugin accumulates code that nobody reviews for years. - **The contact form keeps coming up.** Reading submissions, executing shortcodes, old reflected XSS: it is the most frequently cited module of the period. - **Low-privilege accounts matter.** Most vulnerabilities require a Contributor, Author or Subscriber account. The most frequent type remains XSS, as in the whole ecosystem (see our article on XSS vulnerabilities). - **Backported and pushed fixes.** 102 versions in 2023, 101 in 2024, 42 in 2026: Jetpack also fixes old branches, and wordpress.org forced the update in 2014 and 2023, even on sites that had disabled it. This privilege is reserved for severe cases and does not replace your own updates. Jetpack is not an isolated case: [plugin vulnerabilities number in the thousands every year](https://www.wp-masquerade.com/wordpress-plugin-vulnerabilities-statistics/), and core itself regularly ships security releases, as [our timeline of WordPress core vulnerabilities](https://www.wp-masquerade.com/wordpress-core-vulnerabilities-timeline/) traces. ## Protecting your site - **Update.** As of October 9, 2026, the version to reach is 16.3 or later. On an older branch, check that you are at least on the fix release published for it. - **Turn on automatic updates for Jetpack.** Forced updates are rare; do not count on them. Our guide to automatic plugin updates explains how to set them up safely. - **Turn off unnecessary modules** in Jetpack, and delete the plugin if you no longer use it: an unnecessary plugin is still attack surface. - **Close open registration** if you do not need it, and review the list of Subscriber, Contributor and Author accounts. - **Add a web application firewall** capable of virtual patching to cover the period between a vulnerability's publication and your update: our WAF comparison. - **Monitor published vulnerabilities** for the plugins you use: method and tools. WP Masquerade Pro can help with this last point. Every day, it compares the plugin versions installed on your sites with the public WPVulnerability.net database and sends you [an alert](https://www.wp-masquerade.com/features/vulnerable-plugin-alerts/) by [email](https://www.wp-masquerade.com/features/email-alerts/) with the severity and the fixed version. The member area also lists [pending updates and vulnerable sites](https://www.wp-masquerade.com/features/#surveillance). It alerts, it does not fix and it is not a firewall: updating is still up to you. To choose the other building blocks of your protection, see [our selection of security plugins](https://www.wp-masquerade.com/best-wordpress-security-plugins/). ### Key takeaways - WPScan lists 14 Jetpack vulnerabilities from January 1, 2020 to October 9, 2026, 2 of them rated high and none critical. - No documented exploitation, but three massive waves of fixes: 102 versions in 2023, 101 in 2024, 42 in 2026. - In 2014 and 2023, wordpress.org forced the update, even on sites that had disabled it. - Version to reach as of October 9, 2026: 16.3 or later. - Turn off unnecessary modules and limit accounts: most vulnerabilities require an account, even a modest one. ## Sources - Jetpack: Jetpack 2.9.3: Critical Security Update (April 10, 2014) (https://jetpack.com/resources/jetpack-security-update/) - CVE: CVE-2023-2996, Jetpack before 12.1.1, file manipulation via the API by an author (June 27, 2023) (https://www.cve.org/CVERecord?id=CVE-2023-2996) - CVE: CVE-2024-10075, Jetpack before 13.8, unauthenticated block and shortcode execution (May 15, 2025) (https://www.cve.org/CVERecord?id=CVE-2024-10075) - WordPress.org: Jetpack plugin page (active installations) (https://wordpress.org/plugins/jetpack/) Other sources consulted: further CVE records, official vendor pages, security research publications, trade press articles, WPScan and Patchstack databases.