Jetpack – WP Security, Backup, Speed, & Growth <= 3.9.1 - Sensitive Information Disclosure
2016-02-25 00:00
Oliver LiuStrategic Overview
StatusPatched in 3.9.2
Affected PluginJetpack – WP Security, Backup, Speed, & Growth
Affected Version
<= 3.9.1CVSS4.9Medium
CVE
N/AVulnerability Overview
The Jetpack – WP Security, Backup, Speed, & Growth plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 3.9.1. This makes it possible for authenticated attackers with database access to extract sensitive data including plaintext credentials due to plaintext storage of those credentials.
Technical Analysis
REMEDIATION: Update to version 3.9.2, or a newer patched version --- IDENTIFIER: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C