Jetpack <= 12.6.2 - Improper Authorization via WPCom External Media REST endpoints
Strategic Overview
- Status
- Patched in 12.7
- Affected Plugin
- Jetpack – WP Security, Backup, Speed, & Growth
- Affected Version
< 12.7- CVSS
- 4.3Medium
- Weakness type
- CWE-285 · Improper Authorization
- CVE
CVE-2023-47788
At a glance
CVE-2023-47788 is a medium-severity Improper Authorization vulnerability in the Jetpack WordPress plugin, affecting versions < 12.7. It carries a CVSS score of 4.3 (reachable over the network; low attack complexity). The issue is fixed in version 12.7; sites on affected versions should update now. Disclosed November 2023, reported by Rafie Muhammad.
Vulnerability Overview
The Jetpack plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the WPCom External Media REST permission_callback function in versions up to and including 12.6.2. This makes it possible for authenticated attackers, with contributor-level access and above, to import external media even without the upload_files capability.
Technical Analysis
The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no interaction from a victim user.
CWE-285: Improper Authorization
Reaching this weakness in Jetpack < 12.7 takes a caller who can reach the endpoint. Improper authorization means a permission check exists but does not cover the case being exercised, so a caller who is allowed to do one thing is allowed to do a neighbouring thing as well.
A lower-privileged account performs an action reserved for a higher one, which on a multi-author or membership site means an ordinary user reaching administrative behaviour. For Jetpack the fix is 12.7: builds < 12.7 are affected, anything from 12.7 onward is not.
Remediation
Update to version 12.7, or a newer patched version
How does WordSec protect against this?
Because it turns on account access, WordSec's login security is the relevant layer: role-based two-factor, captcha and brute-force limits raise the cost of getting the account this needs. None of that substitutes for the fix: Jetpack 12.7 closes this, and updating the plugin is the step that ends it.
- Login Security
- Alerts
External References
Related records
Same weakness class
Other vulnerabilities in Jetpack – WP Security, Backup, Speed, & Growth
- 9.8Jetpack – WP Security, Backup, Speed, & Growth < 4.2 Timing Attack
- 9.6Jetpack – WP Security, Backup, Speed, & Growth < 4.2 CSV Injection
- 7.2Jetpack 12.0 - 16.1.2 PHP Object Injection
- 7.2Jetpack <= 3.7.1 Stored Cross-Site Scripting
- 7.2Jetpack <= 3.5.2 Cross-Site Scripting
- 6.6Jetpack PHP Object Injection
- 6.5CVE-2024-10075: Jetpack <= 13.7 Arbitrary Block & Shortcode Execution
CVE-2024-10075 - 6.5CVE-2023-2996: Jetpack <= 12.1 Arbitrary File Manipulation
CVE-2023-2996
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C