The Jetpack plugin version 16.2 and earlier contains an authentication bypass that can be achieved through the password recovery feature. The flaw allows an attacker to use an alternate path or channel to obtain access to a user account without providing a valid password, effectively compromising the confidentiality and integrity of that account. This weakness is identified as CWE‑288.

Automattic Jetpack plugin versions from the earliest release through 16.2 are affected. The vulnerability exists within the WordPress environment when the Jetpack plugin is installed and active, impacting all WordPress sites that rely on Jetpack for connectivity or data synchronization.

The CVSS score of 4.8 places this vulnerability in the lower‑moderate severity range. Because EPSS data is unavailable and the vulnerability is not listed in CISA KEV, the likelihood of widespread exploitation is currently unclear. Based on the description, it is inferred that the flaw can be triggered remotely via the public WordPress interface, making it potentially accessible to attackers who target password‑recovery endpoints. Administrators should consider the risk of credential compromise when deciding on mitigation actions.