Automattic Jetpack CVE-2026-106601

Exploitation targets Jetpack's password-recovery feature specifically, abusing an alternate path or channel (CWE-288) to reach an authenticated state without supplying valid credentials. No authentication is required (PR:N) and no user interaction is needed (UI:N), so any internet-reachable WordPress site running Jetpack ≤16.2 is in scope. The key LIMITING factor is HIGH attack complexity (AC:H): the attacker must satisfy conditions outside their direct control - plausibly a timing/race window or specific state in the recovery flow - making reliable exploitation difficult. The advisory does not name a specific non-default configuration, so exploitation appears tied to the standard password-recovery functionality rather than an optional feature; impact is partial (C:L/I:L, A:N), not full account or site takeover as described.

This is a moderate-severity authentication bypass (CVSS 5.4) in the Jetpack WordPress plugin, affecting versions up to and including 16.2. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) indicates a network-reachable, unauthenticated flaw requiring no user interaction, but with HIGH attack complexity and only LOW confidentiality and integrity impact. The high attack complexity (AC:H) meaningfully constrains real-world exploitability - the attacker likely needs to win a race, control specific preconditions, or satisfy non-trivial requirements in the password-recovery flow, which is consistent with the CWE-288 'alternate path/channel' classification. No EPSS score, CISA KEV listing, SSVC decision data, or POC is present in the provided intelligence, so there is no evidence of active exploitation or automatable mass-exploitation at this time. The single source is a Patchstack advisory, a reputable WordPress-vulnerability provider. Net assessment: this is a real but mid-tier priority - the unauthenticated network vector against a massively deployed plugin raises concern, but the high complexity and limited (partial) impact argue against it being a drop-everything issue. Patch prioritization should be driven by Jetpack's enormous install base rather than by raw severity, which is only MEDIUM.

A remote, unauthenticated attacker abuses an alternate path in Jetpack's password-recovery mechanism to bypass intended authentication checks and gain unauthorized access to a targeted account. Because the CVSS vector specifies high attack complexity, success is not reliable and likely depends on timing or specific preconditions in the recovery workflow. No public exploit identified at time of analysis.