CVE-2023-2996

8.8 highEPSS 4.8%

High (8.8) in automattic jetpack. EPSS 4.8% chance of exploitation in the next 30 days.

The Jetpack WordPress plugin before 12.1.1 does not validate uploaded files, allowing users with author roles or above to manipulate existing files on the site, deleting arbitrary files, and in rare cases achieve Remote Code Execution via phar deserialization.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 4.8% chance of exploitation in the next 30 days; higher than 91% of CVEs (scores of 2026-10-31)
Published: 2023-06-27
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

automattic:jetpack

References

https://jetpack.com/blog/jetpack-12-1-1-critical-security-update/
https://wpscan.com/vulnerability/52d221bd-ae42-435d-a90a-60a5ae530663
https://jetpack.com/blog/jetpack-12-1-1-critical-security-update/
https://wpscan.com/vulnerability/52d221bd-ae42-435d-a90a-60a5ae530663

Check your stack JSON