CVE-2024-10075: Jetpack < 13.8 - Unauthenticated Arbitrary Block & Shortcode Execution
Published May 15, 2025
·Updated
The Jetpack WordPress plugin before 13.8 does not ensure that the post created by the Contact Form is only accessible to authorised users, which could allow unauthenticated users to run arbitrary shortcodes and block.
Affected Software
2 affected components
Automattic Jetpack<13.8
Automattic Jetpack Wordpress<13.8
Event History
May 15, 2025
CVE Published
via MITRE·08:06 PM
Data Sourced
via MITRE·08:06 PM
DescriptionWeakness
Data Sourced
via NVD·08:15 PM
DescriptionSeverity
Frequently Asked Questions
1
What is the severity of CVE-2024-10075?
CVE-2024-10075 is classified as a medium severity vulnerability that may allow unauthenticated users to access sensitive features.
2
How do I fix CVE-2024-10075?
To fix CVE-2024-10075, update the Jetpack WordPress plugin to version 13.8 or later.
3
What can attackers do if they exploit CVE-2024-10075?
If exploited, CVE-2024-10075 allows attackers to run arbitrary shortcodes and block unauthorized content through the Contact Form.
4
Which versions of Jetpack are affected by CVE-2024-10075?
CVE-2024-10075 affects all versions of the Jetpack plugin prior to 13.8.
5
Who is affected by CVE-2024-10075?
Any users of the Jetpack WordPress plugin prior to version 13.8 are at risk due to CVE-2024-10075.