UpHeron
All vulnerabilities

Servers and applications · WordPress plugins

CVE-2021-24374

Jetpack – WP Security, Backup, Speed, & Growth: Authorization Bypass Through User-Controlled Key

Severity
Medium 5.3
Published
1 Jun 2021
Last changed
17 Jun 2026
Added to UpHeron
18 Oct 2026
Fixed in
9.8
Also known as
WPV-ab1c8e15583e
Sources
NVD, WPVulnerability

Description

The Jetpack Carousel module of the JetPack WordPress plugin before 9.8 allows users to create a "carousel" type image gallery and allows users to comment on the images. A security vulnerability was found within the Jetpack Carousel module by nguyenhg_vcs that allowed the comments of non-published page/posts to be leaked.

Affected software

SoftwareAffected versions
JetpackServers and applications · cpe:a:automattic:jetpack
  • Every version before 9.8
JetpackWordPress plugins · wp-plugin:jetpack
  • Every version before 9.8

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-24374
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-24374
  • Wordfence https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/jetpack/jetpack-97-information-disclosure