CVE-2024-9926

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Jetpack WordPress plugin does not have proper authorisation in one of its REST endpoint, allowing any authenticated users, such as subscriber to read arbitrary feedbacks data sent via the Jetpack Contact Form

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected software

VendorProductVersions
UnknownJetpack>= 13.9, < 13.9.1
UnknownJetpack>= 13.8, < 13.8.2
UnknownJetpack>= 13.7, < 13.7.1
UnknownJetpack>= 13.6, < 13.6.1
UnknownJetpack>= 13.5, < 13.5.1
UnknownJetpack>= 13.4, < 13.4.4
UnknownJetpack>= 13.3, < 13.3.2
UnknownJetpack>= 13.2, < 13.2.3
UnknownJetpack>= 13.1, < 13.1.4
UnknownJetpack>= 13.0, < 13.0.1
UnknownJetpack>= 12.9, < 12.9.4
UnknownJetpack>= 12.8, < 12.8.2
UnknownJetpack>= 12.7, < 12.7.2
UnknownJetpack>= 12.6, < 12.6.3
UnknownJetpack>= 12.5, < 12.5.1
UnknownJetpack>= 12.4, < 12.4.1
UnknownJetpack>= 12.3, < 12.3.1
UnknownJetpack>= 12.2, < 12.2.2
UnknownJetpack>= 12.1, < 12.1.2
UnknownJetpack>= 12.0, < 12.0.2
UnknownJetpack>= 11.9, < 11.9.3
UnknownJetpack>= 11.8, < 11.8.6
UnknownJetpack>= 11.7, < 11.7.3
UnknownJetpack>= 11.6, < 11.6.2
UnknownJetpack>= 11.5, < 11.5.3
UnknownJetpack>= 11.4, < 11.4.2
UnknownJetpack>= 11.3, < 11.3.4
UnknownJetpack>= 11.2, < 11.2.2
UnknownJetpack>= 11.1, < 11.1.4
UnknownJetpack>= 11.0, < 11.0.2
UnknownJetpack>= 10.9, < 10.9.3
UnknownJetpack>= 10.8, < 10.8.2
UnknownJetpack>= 10.7, < 10.7.2
UnknownJetpack>= 10.6, < 10.6.2
UnknownJetpack>= 10.5, < 10.5.3
UnknownJetpack>= 10.4, < 10.4.2
UnknownJetpack>= 10.3, < 10.3.2
UnknownJetpack>= 10.2, < 10.2.3
UnknownJetpack>= 10.1, < 10.1.2
UnknownJetpack>= 10.0, < 10.0.2
UnknownJetpack>= 9.9, < 9.9.3
UnknownJetpack>= 9.8, < 9.8.3
UnknownJetpack>= 9.7, < 9.7.3
UnknownJetpack>= 9.6, < 9.6.4
UnknownJetpack>= 9.5, < 9.5.5
UnknownJetpack>= 9.4, < 9.4.4
UnknownJetpack>= 9.3, < 9.3.5
UnknownJetpack>= 9.2, < 9.2.4
UnknownJetpack>= 9.1, < 9.1.3
UnknownJetpack>= 9.0, < 9.0.5

References

Timeline

Published
Nov 7, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-99277.2The WooCommerce Order Proposal plugin for WordPress is vulnerable to privilege escalation via order proposal in all versions up to and incluCVE-2024-99285.3A vulnerability exists in NSD570 login panel that does not restrict excessive authentication attempts. If exploited, this could cause accounCVE-2024-99294.3A vulnerability exists in NSD570 that allows any authenticated user to access all device logs disclosing login information with timestamps.CVE-2024-99309.8The Extensions by HocWP Team plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 0.2.3.2. This is CVE-2024-99319.8The Wux Blog Editor plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.0.0. This is due to missCVE-2024-99329.8The Wux Blog Editor plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'wuxbt_inseCVE-2024-99339.8The WatchTowerHQ plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.10.1. This is due to the 'wCVE-2024-99346.1The Wp-ImageZoom WordPress plugin through 1.1.0 does not sanitise and escape some parameters before outputting them back in a page, leading CVE-2024-99357.5The PDF Generator Addon for Elementor Page Builder plugin for WordPress is vulnerable to Path Traversal in all versions up to, and includingCVE-2024-99366.5When manipulating the selection node cache, an attacker may have been able to cause unexpected behavior, potentially leading to an exploitabCVE-2024-99376.1The Woo Manage Fraud Orders plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions upCVE-2024-99386.1The Bounce Handler MailPoet 3 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions
CVE-2024-9926: Medium severity, CVSS 4.3 | Vulnix