High severity8.8NVD Advisory· Published Jun 27, 2023· Updated Jun 17, 2026

CVE-2023-2996

Description

The Jetpack WordPress plugin before 12.1.1 does not validate uploaded files, allowing users with author roles or above to manipulate existing files on the site, deleting arbitrary files, and in rare cases achieve Remote Code Execution via phar deserialization.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Jetpackllm-fuzzy
Range: <12.1.1
Package: https://wordpress.org/plugins/jetpack

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/52d221bd-ae42-435d-a90a-60a5ae530663nvdExploitThird Party Advisory
jetpack.com/blog/jetpack-12-1-1-critical-security-update/nvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.004
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000