The vulnerability is an authentication bypass that permits an attacker to exploit the password recovery flow in the Jetpack plugin. Because the plugin fails to properly enforce the authentication context, an unauthenticated user can trigger password reset functionality and receive a reset link or recover credentials, effectively compromising user accounts. This flaw enables an attacker to gain unauthorized access to individual WordPress sites without the need to guess or brute‑force passwords.

Automattic's Jetpack plugin for WordPress, versions up through 16.2, are affected. The problem exists in all installations using any earlier version that does not incorporate the fix released in 16.3 and later.

The CVSS score of 5.4 places the issue in the medium severity range, indicating a moderate risk to account confidentiality and integrity. The EPSS score is unavailable, but because the flaw is based on a broken authentication flow it can be executed over the web, making it potentially exploitable by remote attackers. The vulnerability has not yet been catalogued in the CISA KEV list, and no exploit is publicly known, but the lack of a public exploit does not diminish the importance of applying the patch. The likely attack vector is remote, via the WordPress site’s password recovery page or an attacker‑crafted request to the Jetpack password reset endpoint. An attacker who succeeds could assume control of any user account when the password reset link is delivered.