CVE-2023-2996

PoC —

CVSS 3.1

8.8 high

EPSS

5%p91

Published

Jun 27, 2023 (Jun 27, 2023)

Modified

Jun 17, 2026

Description

The Jetpack WordPress plugin before 12.1.1 does not validate uploaded files, allowing users with author roles or above to manipulate existing files on the site, deleting arbitrary files, and in rare cases achieve Remote Code Execution via phar deserialization.

Vendors: automattic
Products: jetpack
Ecosystems: WordPress
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (4.8%)

In the news0 stories

No ingested article mentions this CVE yet.