CVE-2024-10075 Jetpack < 13.8 - Unauthenticated Arbitrary Block & Shortcode Execution
Unauthenticated attackers can execute arbitrary shortcodes and blocks in Jetpack WordPress plugin due to missing authorization checks on contact form posts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-10075?
CVE-2024-10075 is a medium-severity code injection vulnerability in Unknown Jetpack, published on 15 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Jetpack WordPress plugin before 13.8 does not ensure that the post created by the Contact Form is only accessible to authorised users, which could allow unauthenticated users to run arbitrary shortcodes and block.
Which versions are affected by CVE-2024-10075?
It affects 1 product.
Products include Automattic Jetpack.
How do I fix CVE-2024-10075?
No fix has been published for CVE-2024-10075 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-10075 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-10075 exists.
Other vulnerabilities in Unknown Jetpack
- CVE-2023-2996 Jetpack < 12.1.1 - Author+ Arbitrary File Manipulation via API
- CVE-2011-4673 SQL injection in n/a
- CVE-2023-45050 WordPress Jetpack Plugin <= 12.8-a.1 is vulnerable to Cross Site Scripting (XSS)
- CVE-2024-4392 Cross-site scripting in Jetpack – WP Security, Backup, Speed, & Growth
- CVE-2024-10858 Jetpack 13.0-14.0 - Unauthenticated DOM-XSS
Sources
Also known as GHSA-cg9w-78cc-f78x.