UpHeron
All vulnerabilities

Servers and applications · WordPress plugins

CVE-2023-2996

Jetpack – WP Security, Backup, Speed, & Growth: Improper Input Validation

Severity
High 8.8
Published
30 May 2023
Last changed
17 Jun 2026
Added to UpHeron
18 Oct 2026
Fixed in
12.1.1
Also known as
WPV-ed4aaeda07a8
Sources
NVD, WPVulnerability

Description

The Jetpack WordPress plugin before 12.1.1 does not validate uploaded files, allowing users with author roles or above to manipulate existing files on the site, deleting arbitrary files, and in rare cases achieve Remote Code Execution via phar deserialization.

Affected software

SoftwareAffected versions
JetpackServers and applications · cpe:a:automattic:jetpack
  • Every version before 12.1.1
JetpackWordPress plugins · wp-plugin:jetpack
  • Every version before 12.1.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-2996
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-2996
  • Wordfence https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/jetpack/jetpack-121-authenticated-author-arbitrary-file-manipulation