Jetpack CVE-2026-106602

Exploitation targets Jetpack's password-recovery feature specifically: the flaw is an alternate path/channel that bypasses the intended authentication check during password reset (CWE-288), affecting Jetpack versions up to and including 16.2. The CVSS vector (AV:N/PR:N/UI:N) means it is remotely reachable without authentication or user interaction, but AC:H indicates a meaningful limiting factor - the attacker must satisfy conditions outside their direct control (such as timing/state in the recovery workflow), which reduces reliability and makes opportunistic mass exploitation harder. Impact is partial (C:L/I:L, A:N), so this yields limited account compromise rather than full administrative takeover.

This is a moderate-severity (CVSS 4.8) authentication bypass in the Jetpack WordPress plugin, and the available signals collectively point to a real-but-not-urgent issue rather than a top-priority emergency. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates a remotely reachable, unauthenticated flaw, but the High attack complexity (AC:H) is the key tempering factor - successful exploitation depends on conditions the attacker cannot fully control (e.g., winning a race, specific account state, or timing in the password-recovery flow). Impact is limited (C:L/I:L/A:N, Scope Unchanged), consistent with partial account compromise via the alternate recovery channel rather than full takeover or RCE. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no evidence of active exploitation or weaponization. The main risk amplifier here is prevalence, not severity: Jetpack is deployed on a very large number of WordPress sites, so even a niche-complexity auth bypass represents a broad attack surface worth patching promptly. Note that EPSS is entirely absent (not low - missing), so exploitation probability cannot be quantified from this data.

A remote, unauthenticated attacker abuses an alternate path in Jetpack's password-recovery mechanism to bypass authentication controls and gain unauthorized access to a target WordPress account. Because the CVSS vector specifies High attack complexity, the attacker likely must satisfy specific timing or state conditions (not a single trivial request). No public exploit code was identified in the provided data.