CVE-2021-24374 Jetpack < 9.8 - Carousel Module Non-Published Page/Post Attachment Comment Leak

2021-06-2119:18:21

CWE-639

WPScan

www.cve.org

0.001 Low

EPSS

Percentile

46.4%

JSON

The Jetpack Carousel module of the JetPack WordPress plugin before 9.8 allows users to create a “carousel” type image gallery and allows users to comment on the images. A security vulnerability was found within the Jetpack Carousel module by nguyenhg_vcs that allowed the comments of non-published page/posts to be leaked.

CNA Affected

[
  {
    "product": "Jetpack – WP Security, Backup, Speed, & Growth",
    "vendor": "Automattic",
    "versions": [
      {
        "lessThan": "9.8",
        "status": "affected",
        "version": "9.8",
        "versionType": "custom"
      }
    ]
  }
]