Medium · 4.8 CVE-2026-106602 EUVD-2026-95742GHSA-r5qw-hcv6-6phx

WordPress Jetpack plugin <= 16.2 - Broken Authentication vulnerability

Published Oct 9, 2026 · Updated Oct 11, 2026 · Assigned by Patchstack

Description

Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery Exploitation.This issue affects Jetpack: from n/a through 16.2.

Affected products

Vendor	Product	Affected	Fixed
Automattic	Jetpack	≤ 16.2	—

References

https://patchstack.com/database/wordpress/plugin/jetpack/vulnerability/wordpress-jetpack-plugin-16-2-broken-authentication-vulnerability?_s_id=cve vdb-entry