CVE-2026-106602

MediumCVSS 4.8

Published: 09/10/2026(UTC)Updated: 11/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

The Jetpack plugin by Automattic up to version 16.2 contains an authentication bypass using an alternate path or channel vulnerability, allowing password recovery exploitation.

Risk Assessment

An attacker can exploit this vulnerability to take over a user account by manipulating the password recovery process, potentially leading to unauthorized access.

Recommendation

It is recommended to update the Jetpack plugin to a version newer than 16.2 that includes a fix for the vulnerability.

Other vulnerabilities in Jetpack

CVE-2026-106601Medium
The Jetpack plugin by Automattic up to version 16.2 contains an authentication bypass using an alternate path or channel vulnerability, allowing password recovery exploitation.

Original NVD description (English source)

Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery Exploitation.This issue affects Jetpack: from n/a through 16.2.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS