Medium · 5.4 CVE-2026-106601 EUVD-2026-95743GHSA-x9f6-xw7v-m2v4

WordPress Jetpack plugin <= 16.2 - Broken Authentication vulnerability

Published Oct 9, 2026 · Updated Oct 9, 2026 · Assigned by Patchstack

Description

Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery Exploitation.This issue affects Jetpack: from n/a through 16.2.

Affected products

Vendor	Product	Affected	Fixed
Automattic	Jetpack	≤ 16.2	—

References

https://patchstack.com/database/wordpress/plugin/jetpack/vulnerability/wordpress-jetpack-plugin-16-2-broken-authentication-vulnerability-2?_s_id=cve vdb-entry