Exploitation Summary
EIP tracks 2 public exploits for CVE-2024-9926. PoCs published by m3ssap0.
AI-analyzed exploit summary This is a Python-based exploit for CVE-2024-9926, a broken access control vulnerability in WordPress Jetpack versions before 13.9.1. It allows authenticated users to read forms submitted by visitors via an unauthorized REST API endpoint.
Description
The Jetpack WordPress plugin does not have proper authorisation in one of its REST endpoint, allowing any authenticated users, such as subscriber to read arbitrary feedbacks data sent via the Jetpack Contact Form
Exploits (2)
This is a Python-based exploit for CVE-2024-9926, a broken access control vulnerability in WordPress Jetpack versions before 13.9.1. It allows authenticated users to read forms submitted by visitors via an unauthorized REST API endpoint.
This repository provides a vulnerable WordPress environment with Jetpack < 13.9.1 to test CVE-2024-9926, a broken access control vulnerability allowing logged-in users to read submitted forms via REST API endpoints. The PoC includes setup scripts and documentation for exploitation.
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N