Jetpack fixes important data disclosure flaw present since 2016

WordPress plugin Jetpack launched a important safety replace earlier in the present day, addressing a vulnerability that allowed a logged-in person to entry varieties submitted by different guests to the location.

Jetpack is a well-liked WordPress plugin by Automattic that gives instruments to boost web site performance, safety, and efficiency. In response to the seller, the plugin is put in on 27 million web sites.

The problem was found throughout an inner audit and impacts all Jetpack variations since 3.9.9, launched in 2016.

“Throughout an inner safety audit, we discovered a vulnerability with the Contact Kind function in Jetpack ever since model 3.9.9, launched in 2016,” reads the safety bulletin.

“This vulnerability might be utilized by any logged in customers on a website to learn varieties submitted by guests on the location.”

Automattic has launched fixes for 101 impacted variations of Jetpack, all listed under:

13.9.1, 13.8.2, 13.7.1, 13.6.1, 13.5.1, 13.4.4, 13.3.2, 13.2.3, 13.1.4, 13.0.1, 12.9.4, 12.8.2, 12.7.2, 12.6.3, 12.5.1, 12.4.1, 12.3.1, 12.2.2, 12.1.2, 12.0.2, 11.9.3, 11.8.6, 11.7.3, 11.6.2, 11.5.3, 11.4.2, 11.3.4, 11.2.2, 11.1.4, 11.0.2, 10.9.3, 10.8.2, 10.7.2, 10.6.2, 10.5.3, 10.4.2, 10.3.2, 10.2.3, 10.1.2, 10.0.2, 9.9.3, 9.8.3, 9.7.3, 9.6.4, 9.5.5, 9.4.4, 9.3.5, 9.2.4, 9.1.3, 9.0.5, 8.9.4, 8.8.5, 8.7.4, 8.6.4, 8.5.3, 8.4.5, 8.3.3, 8.2.6, 8.1.4, 8.0.3, 7.9.4, 7.8.4, 7.7.6, 7.6.4, 7.5.7, 7.4.5, 7.3.5, 7.2.5, 7.1.5, 7.0.5, 6.9.4, 6.8.5, 6.7.4, 6.6.5, 6.5.4, 6.4.6, 6.3.7, 6.2.5, 6.1.5, 6.0.4, 5.9.4, 5.8.4, 5.7.5, 5.6.5, 5.5.5, 5.4.4, 5.3.4, 5.2.5, 5.1.4, 5.0.3, 4.9.3, 4.8.5, 4.7.4, 4.6.3, 4.5.3, 4.4.5, 4.3.5, 4.2.5, 4.1.4, 4.0.7, 3.9.10

Web site house owners and admins who depend on Jetpack must verify if their plugin has robotically upgraded to one of many variations listed above and carry out a handbook improve if it hasn’t.

Jetpack says there is no such thing as a proof that malicious actors exploited the flaw in its eight years of existence, however it advises customers to improve to a patched launch as quickly as attainable.

“We’ve no proof that this vulnerability has been exploited within the wild. Nonetheless, now that the replace has been launched, it’s attainable that somebody will attempt to make the most of this vulnerability,”  warned Jetpack.

Be aware that there aren’t any mitigations or workarounds for this flaw, so making use of the out there updates is the one out there and advisable answer.

Technical particulars in regards to the flaw and the way it may be exploited have been withheld for now to permit customers a while to use the safety updates.