Jetpack <= 4.8.1 - Unauthenticated Denial of Service via _jb_static Concatenation Endpoint
- ID
- WPSEC-2026-2709
- Plugin
- Jetpack Boost – Website Speed, Performance and Critical CSS (jetpack-boost)
- Affected
- all versions before 4.8.2
- Remediation
- Update to 4.8.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weakness
- CWE-400
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-07
- Attack surface
- Jetpack on WPSec AttackSurface
- Fix released
- Published
Description
The Jetpack Boost plugin for WordPress is vulnerable to Denial of Service via the _jb_static script and style concatenation endpoint in all versions up to, and including, 4.8.1. This is due to the endpoint accepting any caller-supplied list of the site's CSS and JavaScript files, decompressing encoded lists without a size limit, applying no limit to the size of the files read or the output built, and writing every response to a disk cache keyed on a hash of the raw request URI with no limit on the cache directory's size. This makes it possible for unauthenticated attackers to fill the server's disk with cache files and use up its CPU. They do this by sending many concatenation requests whose URIs differ only slightly.
References
- https://wpsec.com/vuln/WPSEC-2026-2709/
- https://plugins.svn.wordpress.org/jetpack-boost/tags/4.8.2/
- https://wordpress.org/plugins/jetpack-boost/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS