Automattic released urgent security updates for its Jetpack plugin—active on over 27 million WordPress sites—resolving a high-risk information disclosure vulnerability tracked as CVE-2024-9926. The vulnerability stems from broken access control (CWE-862) within the Contact_Form_Endpoint REST API handler, which failed to validate caller authorization capabilities via current_user_can(). As a result, any authenticated user with baseline privileges, such as a default Subscriber or Customer account, could directly query the endpoint to retrieve arbitrary feedback submissions, exposing visitor names, email addresses, phone numbers, and unencrypted messages.

The flaw persisted undetected for over eight years, affecting all Jetpack releases starting with version 3.9.9 deployed in 2016 up through version 13.9.0. While Automattic identified the issue during an internal audit and reported no active exploitation before disclosure, the vendor collaborated with the WordPress.org security team to push forced background updates across 101 legacy and active release branches. Patches were backported to 13.9.1, 13.8.2, 13.7.1, and corresponding legacy milestones, mitigating exposure for unmanaged sites.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: Missing authorization boundaries on exposed REST API endpoints negate WordPress role-based access controls, allowing low-tier credentials to read database-backed form telemetry without administrative privileges.
• Bullet 2 — Strategic & Defender Imperative: Site operators must verify that auto-update mechanisms successfully upgraded Jetpack to version 13.9.1 or its patched branch equivalent, while auditing historical REST logs for unauthorized queries targeting contact endpoints.