# Jetpack <= 4.8.1 - Authenticated (Subscriber+) Missing Authorization to Jetpack Connection Ownership Takeover

- **ID:** WPSEC-2026-2708
- **Plugin:** Jetpack Boost – Website Speed, Performance and Critical CSS (`jetpack-boost`), https://wordpress.org/plugins/jetpack-boost/
- **Affected versions:** all versions before 4.8.2
- **Fixed in:** 4.8.2 (Update to 4.8.2 or later.)
- **Severity:** Medium 4.2 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-07)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/jetpack-boost
- **Fix released:** 2026-11-06
- **Published:** 2026-11-07
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2708/

## Description

The Jetpack Boost plugin for WordPress is vulnerable to unauthorized connection ownership takeover via the bundled Jetpack Connection user authorization flow in all versions up to, and including, 4.8.1. This is due to a missing capability check in Manager::authorize(): any user who completes the WordPress.com authorization while the site has no connected owner is stored as the connection owner. The authorization URL and its nonce can be obtained by any logged-in user through the connect_url_redirect webhook handler. This makes it possible for authenticated attackers with Subscriber-level access and above to become the owner of the site's Jetpack connection with their own WordPress.com account when the original owner's connection is missing.

## References

- https://wpsec.com/vuln/WPSEC-2026-2708/
- https://plugins.svn.wordpress.org/jetpack-boost/tags/4.8.2/
- https://wordpress.org/plugins/jetpack-boost/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2708/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.