GHSA-5hr6-r8h6-wh22

JetPack Exposure of Resource to Wrong Sphere

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-24374

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	automattic/jetpack	< 9.8	9.8

Details

As written in the advisory (Markdown source, shown as plain text).

The Jetpack Carousel module of the JetPack WordPress plugin before 9.8 allows users to create a "carousel" type image gallery and allows users to comment on the images. A security vulnerability was found within the Jetpack Carousel module by nguyenhg_vcs that allowed the comments of non-published page/posts to be leaked.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-24374 advisory
https://github.com/Automattic/jetpack-production package
https://jetpack.com/2021/06/01/jetpack-9-8-engage-your-audience-with-wordpress-stories web
https://wpscan.com/vulnerability/08a8a51c-49d3-4bce-b7e0-e365af1d8f33 web