Jetpack <= 4.8.1 - Authenticated (Subscriber+) Missing Authorization to Jetpack Connection Ownership Takeover
- ID
- WPSEC-2026-2708
- Plugin
- Jetpack Boost – Website Speed, Performance and Critical CSS (jetpack-boost)
- Affected
- all versions before 4.8.2
- Remediation
- Update to 4.8.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-07
- Attack surface
- Jetpack on WPSec AttackSurface
- Fix released
- Published
Description
The Jetpack Boost plugin for WordPress is vulnerable to unauthorized connection ownership takeover via the bundled Jetpack Connection user authorization flow in all versions up to, and including, 4.8.1. This is due to a missing capability check in Manager::authorize(): any user who completes the WordPress.com authorization while the site has no connected owner is stored as the connection owner. The authorization URL and its nonce can be obtained by any logged-in user through the connect_url_redirect webhook handler. This makes it possible for authenticated attackers with Subscriber-level access and above to become the owner of the site's Jetpack connection with their own WordPress.com account when the original owner's connection is missing.
References
- https://wpsec.com/vuln/WPSEC-2026-2708/
- https://plugins.svn.wordpress.org/jetpack-boost/tags/4.8.2/
- https://wordpress.org/plugins/jetpack-boost/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS