{
 "id": "WPSEC-2026-2709",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2709/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2709/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2709/index.md",
 "title": "Jetpack <= 4.8.1 - Unauthenticated Denial of Service via _jb_static Concatenation Endpoint",
 "description": "The Jetpack Boost plugin for WordPress is vulnerable to Denial of Service via the _jb_static script and style concatenation endpoint in all versions up to, and including, 4.8.1. This is due to the endpoint accepting any caller-supplied list of the site's CSS and JavaScript files, decompressing encoded lists without a size limit, applying no limit to the size of the files read or the output built, and writing every response to a disk cache keyed on a hash of the raw request URI with no limit on the cache directory's size. This makes it possible for unauthenticated attackers to fill the server's disk with cache files and use up its CPU. They do this by sending many concatenation requests whose URIs differ only slightly.",
 "plugin": {
  "slug": "jetpack-boost",
  "name": "Jetpack",
  "full_name": "Jetpack Boost – Website Speed, Performance and Critical CSS",
  "wordpress_org": "https://wordpress.org/plugins/jetpack-boost/",
  "advisories_url": "https://wpsec.com/vuln/plugin/jetpack-boost/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/jetpack-boost"
 },
 "type": "DOS",
 "cwe": [
  "CWE-400"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.8.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.8.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.8.2",
 "remediation": "Update to 4.8.2 or later.",
 "fix_released": "2026-11-06T11:46:04+00:00",
 "published": "2026-11-07T12:41:15+00:00",
 "updated": "2026-11-07T11:06:37.696492+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2709/",
  "https://plugins.svn.wordpress.org/jetpack-boost/tags/4.8.2/",
  "https://wordpress.org/plugins/jetpack-boost/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/jetpack-boost",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-07"
 }
}