-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| automattic/jetpack | composer | < 9.8 | 9.8 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper access control in comment retrieval for carousel images. The Carousel module's comment features likely use functions that: 1. Accept user-supplied attachment/post IDs (CWE-639) 2. Fail to verify if the parent post/page is published (CWE-284) 3. Expose comments from draft/private content (CWE-668). The functions responsible for comment fetching (both regular and AJAX endpoints) would be the primary vectors, as they handle the sensitive data retrieval without proper authorization checks. This matches the pattern of vulnerabilities where endpoints return data without validating the user's right to access the associated resource.