# Authentication bypass on JetPack SSO manager - Allows to access the administration panel of wordpress without user interaction

WordPress.com invite acceptance auto-verifies an unconfirmed email, letting an attacker claim a victim's email and SSO into a Jetpack site as that user.

- Payout: hidden
- Severity: high
- Program: Automattic
- Found by: hundredpercent
- Disclosed: 2023-12-28
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/2037902
- Library page: https://bugbountylibrary.com/r/h1%3A2037902
- Tags: area:web domain:web impact:ato impact:privesc kind:bounty platform:hackerone sev:high tech:oauth tech:wordpress technique:chained vuln:account-takeover vuln:auth-bypass

**Target:** Jetpack SSO manager / WordPress.com account email verification
**Root cause:** Accepting a WordPress.com invite marks the invited account's email as verified without proving ownership of that mailbox. Jetpack SSO with 'Match accounts using email addresses' then trusts that verified email to map to a local WordPress user.
**Steps:**
1. Enable Jetpack SSO and 'Match accounts using email addresses' on host.com; create local user something@company.com
2. Attacker creates confirmed WordPress.com account A (personal email) and unconfirmed account B (something@company.com)
3. From A, invite B via Settings > Users
4. Log into B, accept the invitation in notifications; B's email becomes verified without mailbox confirmation
5. In same browser as B, visit host.com and click 'Sign in with WordPress.com'
6. Get logged in as the local admin/user owning something@company.com
**How found:** Researcher noticed SSO requires a confirmed WordPress.com email, then observed that accepting an invite verifies the invited email without mailbox ownership, and hypothesized the verified email would satisfy Jetpack's email-matching SSO.
**Exploitation:** Attacker needs a target Jetpack site with SSO and email matching enabled and a local account whose email they don't control. They self-invite that email from a controlled WordPress.com account, accept it to force verification, then use WordPress.com SSO to authenticate as the victim local user, gaining admin panel access with no victim interaction.
**Escalation:** Chained two flaws: invite-acceptance email verification bypass plus Jetpack SSO email-matching to convert a WordPress.com account into local WordPress admin access.
**Insight:** When SSO maps identities by email, audit every path that can flip an account's email to 'verified' — invite acceptance, org membership, or domain-claim flows — since any of them becomes an account-takeover primitive against downstream sites trusting that email.