CVE-2026-22356: Jetpack CRM Path Traversal Vulnerability

CVE-2026-22356 Overview

CVE-2026-22356 is a PHP Local File Inclusion (LFI) vulnerability affecting Automattic's Jetpack CRM plugin (also known as zero-bs-crm) for WordPress. The vulnerability stems from improper control of filename for include/require statements, allowing attackers to include local PHP files on the server. This flaw can lead to information disclosure, remote code execution under certain conditions, and full site compromise.

Critical Impact

Successful exploitation of this Local File Inclusion vulnerability could allow unauthenticated attackers to read sensitive files, access configuration data, or potentially achieve code execution on affected WordPress installations running Jetpack CRM versions through 6.7.0.

Affected Products

• Jetpack CRM (zero-bs-crm) versions from n/a through <= 6.7.0
• WordPress installations with vulnerable Jetpack CRM plugin installed
• Self-hosted WordPress sites utilizing Jetpack CRM for customer relationship management

Discovery Timeline

• 2026-02-20 - CVE-2026-22356 published to NVD
• 2026-02-24 - Last updated in NVD database

Technical Details for CVE-2026-22356

Vulnerability Analysis

This vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). The flaw exists in the Jetpack CRM plugin where user-controlled input is passed to PHP file inclusion functions (include(), require(), include_once(), or require_once()) without proper sanitization or validation.

PHP Local File Inclusion vulnerabilities occur when an application dynamically includes PHP files based on user input. When filenames are not properly validated, attackers can manipulate the input to traverse directory structures and include arbitrary local files from the web server's filesystem.

The vulnerability requires network access and some user interaction to exploit, though no authentication is required. Successful exploitation can result in complete compromise of confidentiality, integrity, and availability of the affected WordPress installation.

Root Cause

The root cause of this vulnerability lies in insufficient input validation when processing user-supplied data that influences file path construction for PHP include/require operations. The Jetpack CRM plugin fails to adequately sanitize or whitelist acceptable file paths, enabling path traversal sequences and arbitrary file inclusion.

When user input is concatenated or directly used in file inclusion statements without proper filtering, attackers can inject path traversal sequences (such as ../) to escape the intended directory and include sensitive files from elsewhere on the system.

Attack Vector

The attack vector is network-based, requiring the attacker to send specially crafted requests to the vulnerable WordPress installation. The exploitation scenario typically involves:

The attacker identifies a vulnerable endpoint in the Jetpack CRM plugin that accepts user input for file inclusion. By manipulating the filename parameter with path traversal sequences, the attacker can force the application to include unintended files. Common targets include configuration files like wp-config.php, log files, or other PHP files that could reveal sensitive information or execute malicious code.

For technical details on the vulnerability mechanism, refer to the Patchstack Vulnerability Report.

Detection Methods for CVE-2026-22356

Indicators of Compromise

• Unusual HTTP requests containing path traversal sequences (../, ..%2f, ....//) targeting Jetpack CRM endpoints
• Access log entries showing requests with suspicious file path manipulation patterns
• Unexpected file access attempts in application or system logs, particularly targeting configuration files
• Evidence of information disclosure such as leaked database credentials or WordPress configuration data

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block path traversal attempts in request parameters
• Monitor server access logs for requests containing directory traversal patterns targeting the zero-bs-crm plugin directory
• Implement file integrity monitoring on critical WordPress configuration files
• Configure intrusion detection systems to alert on Local File Inclusion attack signatures

Monitoring Recommendations

• Enable verbose logging for the Jetpack CRM plugin and WordPress application
• Set up alerting for unusual file read operations outside normal application directories
• Monitor for privilege escalation attempts following potential LFI exploitation
• Review authentication logs for anomalous behavior following suspicious file inclusion attempts

How to Mitigate CVE-2026-22356

Immediate Actions Required

• Update Jetpack CRM to a patched version immediately if available
• Temporarily disable the Jetpack CRM plugin if an update is not yet available and the site is at risk
• Implement WAF rules to block path traversal attempts targeting WordPress plugins
• Review access logs for any indication of prior exploitation attempts

Patch Information

The vulnerability affects Jetpack CRM versions through 6.7.0. Users should check the Patchstack Vulnerability Report for the latest patch information and update guidance. Apply available security updates through the WordPress plugin administration interface as soon as a patched version is released by Automattic.

Workarounds

• Implement web server-level access controls to restrict direct access to plugin files
• Deploy a Web Application Firewall with rules specifically blocking LFI attack patterns
• Restrict filesystem permissions on sensitive WordPress configuration files to prevent unauthorized reads
• Consider using WordPress security plugins that provide additional input validation and path traversal protection

# Example: Apache .htaccess rule to block path traversal attempts
RewriteEngine On
RewriteCond %{QUERY_STRING} (\.\./|\.\.%2f|\.\.\\) [NC,OR]
RewriteCond %{REQUEST_URI} (\.\./|\.\.%2f|\.\.\\) [NC]
RewriteRule .* - [F,L]