UpHeron
All vulnerabilities

Servers and applications · WordPress plugins

CVE-2014-0173

Vulnerability in Jetpack – WP Security, Backup, Speed, & Growth

Severity
Medium 5.8
Published
3 Dec 2013
Last changed
17 Jun 2026
Added to UpHeron
18 Oct 2026
Fixed in
2.9.3
Also known as
WPV-cf031375dd7d
Sources
NVD, WPVulnerability

Description

The Jetpack plugin before 1.9 before 1.9.4, 2.0.x before 2.0.9, 2.1.x before 2.1.4, 2.2.x before 2.2.7, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.2, 2.6.x before 2.6.3, 2.7.x before 2.7.2, 2.8.x before 2.8.2, and 2.9.x before 2.9.3 for WordPress does not properly restrict access to the XML-RPC service, which allows remote attackers to bypass intended restrictions and publish posts…

Affected software

SoftwareAffected versions
JetpackServers and applications · cpe:a:automattic:jetpack
  • Version 2.9.3
  • Version 2.9.2
  • Version 2.9.1
  • Version 2.9
All 35 release lines
  • Version 1.9
  • Version 1.9.1
  • Version 1.9.2
  • Version 2.0
  • Version 2.0.1
  • Version 2.0.2
  • Version 2.0.3
  • Version 2.0.4
  • Version 2.1
  • Version 2.1.1
  • Version 2.1.2
  • Version 2.2
  • Version 2.2.1
  • Version 2.2.2
  • Version 2.2.3
  • Version 2.2.4
  • Version 2.2.5
  • Version 2.3
  • Version 2.3.1
  • Version 2.3.2
  • Version 2.3.3
  • Version 2.3.4
  • Version 2.3.5
  • Version 2.4
  • Version 2.4.1
  • Version 2.4.2
  • Version 2.5
  • Version 2.6
  • Version 2.6.1
  • Version 2.7
  • Version 2.8
  • Version 2.9
  • Version 2.9.1
  • Version 2.9.2
  • Version 2.9.3
JetpackWordPress plugins · wp-plugin:jetpack
  • Every version before 2.9.3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2014-0173
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2014-0173
  • Wordfence https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/jetpack/jetpack-293-security-bypass