CVE-2023-47788 MEDIUM

CVE-2023-47788: WordPress Jetpack plugin < 12.7 - Contributor+ Broken Access Control vulnerability

Vendor Automattic

Product Jetpack

Weakness CWE-862 · Missing authorization

Published June 19, 2024

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

4.3/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality None

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

What the vulnerability does

01Description

Missing Authorization vulnerability in Automattic Jetpack.This issue affects Jetpack: from n/a before 12.7.

Explanation of Vulnerability in Simple Terms

02Summary

Jetpack versions before 12.7 lack proper authorization checks, allowing authenticated users with low privileges to trigger a denial-of-service condition. An attacker with a valid account can make requests that degrade site availability. The vulnerability requires an existing user account but no special permissions. Update to version 12.7 or later to resolve this issue.

What an attacker can do

03Attacker Capabilities

An authenticated user can make requests that degrade site availability.

Potential impact on your site

04Site Impact

Site availability may be degraded by authenticated users making malicious requests.

Conditions required to exploit

05Prerequisites

Attacker must have a valid Jetpack user account with low-level privileges.

Key dates

06Disclosure timeline

June 19, 2024 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-47788 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/862.html AskarLabs — CWE-862 write-up Missing Authorization

Related vulnerabilities