Web Application Firewall Rule Bypass in Jetpack WAF Runtime
Jetpack’s bundled Web Application Firewall did not clear its cached MATCHED_VAR/MATCHED_VARS metadata between rule evaluations, so a rule referencing those targets kept receiving a previous rule’s stale match data. A remote attacker could craft a request that makes later firewall rules evaluate the wrong content, masking malicious input and bypassing WAF protection. Any site relying on the Jetpack firewall to block attacks is affected.
This vulnerability affects the following application versions:
- Jetpack 15.6
- Jetpack 15.6.1
- Jetpack 15.6-a.3
- Jetpack 15.6-a.5
- Jetpack 15.6-a.7
- Jetpack 15.6-beta
- Jetpack 15.7-a.1
- Jetpack 15.7-a.3