CVE-2026-106602 Details
Description
Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery Exploitation.This issue affects Jetpack: from n/a through 16.2.
A vulnerability allowing authentication bypass has been identified in the Automattic Jetpack plugin for WordPress, affecting versions through 16.2. This vulnerability allows attackers to exploit the password recovery process, bypassing the normal authentication mechanisms.
Users of the Jetpack plugin should update to version 16.3 or later. Patchstack users can enable auto-update for vulnerable plugins.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 9, 2026CISA-ADP
Assessed Oct 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://patchstack.com/database/wordpress/plugin/jetpack/vulnerability/wordpress-jetpack-plugin-16-2-broken-authentication-vulnerability?_s_id=cve | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-288 | Authentication Bypass Using an Alternate Path or Channel | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Automattic Jetpack | <= 16.2 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 11, 2026 | CVE Modified | CISA-ADP |
| Oct 9, 2026 | New CVE Received | [email protected] |