AIKIDO-2026-701086
wp-plugin/jetpack is vulnerable to Authentication Bypass Using an Alternate Path or Channel
48
CVE Score
Medium
Authentication Bypass Using an Alternate Path or Channel
TL;DR
Jetpack allowed an unauthenticated attacker to bypass the login system and log in as other users without their password by exploiting the plugin's password recovery flow. Any WordPress site running the plugin within the affected range was exposed, since the attack required no privileges. The fix removes the password recovery bypass.
How do I fix this?
Upgrade the wp-plugin/jetpack package to 16.3 or later.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range of wp-plugin/jetpack.
Package
Versions
2.0.9 - 16.2
Fixed in 16.3Background info
wp-plugin/jetpack is vulnerable to Authentication Bypass Using an Alternate Path or Channel in versions 2.0.9 - 16.2.
Links
CVE Detail
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.