CVE-2024-10075

Description

The Jetpack WordPress plugin before 13.8 does not ensure that the post created by the Contact Form is only accessible to authorised users, which could allow unauthenticated users to run arbitrary shortcodes and block.

Reserved 2024-10-17 | Published 2025-05-15 | Updated 2025-05-20 | Assigner WPScan

Problem types

CWE-639 Authorization Bypass Through User-Controlled Key

Product status

Default status
unaffected

Any version before 13.8
affected

Credits

Marc Montpas finder

WPScan coordinator

References

wpscan.com/...rability/a984976c-291a-4f68-90d4-e452605ea7d1/ exploit vdb-entry technical-description

cve.org (CVE-2024-10075)

nvd.nist.gov (CVE-2024-10075)

Download JSON