Jetpack 3.2 - 16.1.2 - Missing Authorization on WPCOM Media API Attachment Parent

The Jetpack – WP Security, Backup, Speed, & Growth plugin for WordPress is vulnerable to Missing Authorization in versions 3.2 through 16.1.2 via the WPCOM JSON API media upload and update endpoints. Early releases accepted the destination as post_ID, while later releases used parent_id; both values were written to an attachment’s post_parent without checking whether the caller could edit the destination post. Authorization was limited to upload_files and, in later update implementations, permission to edit the media item itself. This makes it possible for authenticated attackers with an account linked to the Jetpack connection and the upload_files capability, which is Author and above by default, to attach an arbitrary media item to a post they do not own. Where the target post uses a bare [gallery] shortcode or a theme that calls get_attached_media()/get_children(), the attacker's media then renders inside the victim's post. The endpoints are reached only through the WordPress.com HMAC-signed jetpack.jsonAPI XML-RPC proxy, not via a /wp-json route.

Because it turns on account access, WordSec's login security is the relevant layer: role-based two-factor, captcha and brute-force limits raise the cost of getting the account this needs. None of that substitutes for the fix: Jetpack 16.1.3 closes this, and updating the plugin is the step that ends it.

• Login Security
• Alerts