Jetpack – WP Security, Backup, Speed, & Growth

{
    "slug": "jetpack",
    "author_slug": "kraftbj",
    "burst_start": "2026-09-01 13:55:26",
    "burst_end": "2026-09-01 15:08:06",
    "burst_commits": 43,
    "burst_window_minutes": 90,
    "tenure_days": 2735,
    "distinct_messages": 43,
    "avg_message_length": 14.3,
    "top_message": "Jetpack 16.1.3",
    "top_message_count": 1,
    "prt_revert": null,
    "explanation": "Established author committed 43 revisions inside a 90-minute window with low-entropy commit messages. Pattern matches the June 2024 wp.org credential-stuffing wave shape; bumped to critical when followed by a wp.org Plugin Review Team revert within 7 days."
}

{
    "slug": "jetpack",
    "author_slug": "kraftbj",
    "burst_start": "2026-09-01 13:55:26",
    "burst_end": "2026-09-01 15:08:06",
    "burst_commits": 43,
    "burst_window_minutes": 90,
    "tenure_days": 2735,
    "distinct_messages": 43,
    "avg_message_length": 14.3,
    "top_message": "Jetpack 16.1.3",
    "top_message_count": 1,
    "prt_revert": null,
    "explanation": "Established author committed 43 revisions inside a 90-minute window with low-entropy commit messages. Pattern matches the June 2024 wp.org credential-stuffing wave shape; bumped to critical when followed by a wp.org Plugin Review Team revert within 7 days."
}

{
    "slug": "jetpack",
    "author_slug": "kraftbj",
    "burst_start": "2026-09-01 13:55:26",
    "burst_end": "2026-09-01 15:08:06",
    "burst_commits": 43,
    "burst_window_minutes": 90,
    "tenure_days": 2735,
    "distinct_messages": 43,
    "avg_message_length": 14.3,
    "top_message": "Jetpack 16.1.3",
    "top_message_count": 1,
    "prt_revert": null,
    "explanation": "Established author committed 43 revisions inside a 90-minute window with low-entropy commit messages. Pattern matches the June 2024 wp.org credential-stuffing wave shape; bumped to critical when followed by a wp.org Plugin Review Team revert within 7 days."
}

{
    "slug": "jetpack",
    "author_slug": "kraftbj",
    "burst_start": "2026-09-01 13:55:26",
    "burst_end": "2026-09-01 15:08:06",
    "burst_commits": 43,
    "burst_window_minutes": 90,
    "tenure_days": 2735,
    "distinct_messages": 43,
    "avg_message_length": 14.3,
    "top_message": "Jetpack 16.1.3",
    "top_message_count": 1,
    "prt_revert": null,
    "explanation": "Established author committed 43 revisions inside a 90-minute window with low-entropy commit messages. Pattern matches the June 2024 wp.org credential-stuffing wave shape; bumped to critical when followed by a wp.org Plugin Review Team revert within 7 days."
}

{
    "slug": "jetpack",
    "author_slug": "kraftbj",
    "burst_start": "2026-09-01 13:55:26",
    "burst_end": "2026-09-01 15:08:06",
    "burst_commits": 43,
    "burst_window_minutes": 90,
    "tenure_days": 2735,
    "distinct_messages": 43,
    "avg_message_length": 14.3,
    "top_message": "Jetpack 16.1.3",
    "top_message_count": 1,
    "prt_revert": null,
    "explanation": "Established author committed 43 revisions inside a 90-minute window with low-entropy commit messages. Pattern matches the June 2024 wp.org credential-stuffing wave shape; bumped to critical when followed by a wp.org Plugin Review Team revert within 7 days."
}

{
    "slug": "jetpack",
    "author_slug": "kraftbj",
    "burst_start": "2026-09-01 13:55:26",
    "burst_end": "2026-09-01 15:08:06",
    "burst_commits": 43,
    "burst_window_minutes": 90,
    "tenure_days": 2735,
    "distinct_messages": 43,
    "avg_message_length": 14.3,
    "top_message": "Jetpack 16.1.3",
    "top_message_count": 1,
    "prt_revert": null,
    "explanation": "Established author committed 43 revisions inside a 90-minute window with low-entropy commit messages. Pattern matches the June 2024 wp.org credential-stuffing wave shape; bumped to critical when followed by a wp.org Plugin Review Team revert within 7 days."
}

{
    "slug": "jetpack",
    "author_slug": "kraftbj",
    "burst_start": "2026-09-01 13:55:26",
    "burst_end": "2026-09-01 15:08:06",
    "burst_commits": 43,
    "burst_window_minutes": 90,
    "tenure_days": 2735,
    "distinct_messages": 43,
    "avg_message_length": 14.3,
    "top_message": "Jetpack 16.1.3",
    "top_message_count": 1,
    "prt_revert": null,
    "explanation": "Established author committed 43 revisions inside a 90-minute window with low-entropy commit messages. Pattern matches the June 2024 wp.org credential-stuffing wave shape; bumped to critical when followed by a wp.org Plugin Review Team revert within 7 days."
}

{
    "slug": "jetpack",
    "previous_version": "15.8",
    "current_version": "15.9.1",
    "new_findings": [
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "modules/videopress/class.videopress-player.php",
            "line": 717,
            "snippet": "wp_enqueue_script( 'videopress-iframe', 'https://videopress.com/videopress-iframe.js', array(), JETPACK__VERSION, true );",
            "confidence": "medium",
            "details": {
                "url": "https://videopress.com/videopress-iframe.js",
                "url_host": "videopress.com"
            }
        }
    ],
    "new_finding_count": 1
}

{
    "slug": "jetpack",
    "new_contributors": [
        "jennywp",
        "ryanc413"
    ],
    "active_installs": 3000000
}

{
    "slug": "jetpack",
    "new_contributors": [
        "jennywp",
        "ryanc413"
    ],
    "active_installs": 3000000
}

{
    "slug": "jetpack",
    "new_contributors": [
        "jenhooks"
    ],
    "active_installs": 3000000
}

{
    "slug": "jetpack",
    "finding_count": 8,
    "findings": [
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "extensions/blocks/pinterest/pinterest.php",
            "line": 241,
            "snippet": "wp_enqueue_script( 'pinterest-pinit', 'https://assets.pinterest.com/js/pinit.js', array(), JETPACK__VERSION, true );",
            "confidence": "medium",
            "details": {
                "url": "https://assets.pinterest.com/js/pinit.js",
                "url_host": "assets.pinterest.com"
            }
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "extensions/blocks/tock/tock.php",
            "line": 51,
            "snippet": "wp_enqueue_script( 'tock-widget', 'https://www.exploretock.com/tock.js', array(), JETPACK__VERSION, true );",
            "confidence": "medium",
            "details": {
                "url": "https://www.exploretock.com/tock.js",
                "url_host": "www.exploretock.com"
            }
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "extensions/blocks/eventbrite/eventbrite.php",
            "line": 121,
            "snippet": "wp_enqueue_script( 'eventbrite-widget', 'https://www.eventbrite.com/static/widgets/eb_widgets.js', array(), JETPACK__VERSION, true );",
            "confidence": "medium",
            "details": {
                "url": "https://www.eventbrite.com/static/widgets/eb_widgets.js",
                "url_host": "www.eventbrite.com"
            }
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "extensions/blocks/eventbrite/eventbrite.php",
            "line": 210,
            "snippet": "wp_enqueue_script( 'eventbrite-widget', 'https://www.eventbrite.com/static/widgets/eb_widgets.js', array(), JETPACK__VERSION, true );",
            "confidence": "medium",
            "details": {
                "url": "https://www.eventbrite.com/static/widgets/eb_widgets.js",
                "url_host": "www.eventbrite.com"
            }
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "extensions/blocks/calendly/calendly.php",
            "line": 87,
            "snippet": "wp_enqueue_style( 'jetpack-calendly-external-css', 'https://assets.calendly.com/assets/external/widget.css', null, JETPACK__VERSION );",
            "confidence": "medium",
            "details": {
                "url": "https://assets.calendly.com/assets/external/widget.css",
                "url_host": "assets.calendly.com"
            }
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "modules/videopress/shortcode.php",
            "line": 176,
            "snippet": "wp_register_script( 'videopress', 'https://v0.wordpress.com/js/videopress.js', array( 'jquery', 'swfobject' ), '1.09', false );",
            "confidence": "medium",
            "details": {
                "url": "https://v0.wordpress.com/js/videopress.js",
                "url_host": "v0.wordpress.com"
            }
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "modules/shortcodes/tweet.php",
            "line": 174,
            "snippet": "wp_register_script( 'twitter-widgets', 'https://platform.twitter.com/widgets.js', array(), JETPACK__VERSION, true );",
            "confidence": "medium",
            "details": {
                "url": "https://platform.twitter.com/widgets.js",
                "url_host": "platform.twitter.com"
            }
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "modules/gravatar-hovercards.php",
            "line": 273,
            "snippet": "wp_enqueue_script( 'grofiles-cards', 'https://secure.gravatar.com/js/gprofiles.js', array(), GROFILES__CACHE_BUSTER, true );",
            "confidence": "medium",
            "details": {
                "url": "https://secure.gravatar.com/js/gprofiles.js",
                "url_host": "secure.gravatar.com"
            }
        }
    ],
    "triage_note_2026_05_03": "jetpack: remote_enqueue matches are intentional widget integrations (pinterest, eventbrite, calendly, twitter, gravatar, videopress). Automattic-owned, intentional vendor JS embeds."
}

{
    "slug": "jetpack",
    "new_contributors": [
        "jennywp"
    ],
    "active_installs": 3000000
}

{
    "slug": "jetpack",
    "committer_slug": "veryhappytiger",
    "committer_display_name": "veryhappytiger (a11n)",
    "committer_employer": null,
    "committer_member_since": "2025-01-15",
    "committer_first_commit": "2025-11-11 00:53:25",
    "committer_commit_count": 16,
    "plugin_listed_author": "automattic",
    "earliest_plugin_commit": "2024-08-06 16:30:06",
    "plugin_age_at_join_days": 461,
    "committer_age_at_join_days": 300,
    "active_installs": 3000000
}

{
    "slug": "jetpack",
    "pattern": "unserialize_after_remote_call",
    "kind": "builtin",
    "version": "15.7.1",
    "hit_count": 2,
    "first_hit": {
        "file": "jetpack_vendor/automattic/jetpack-waf/src/class-waf-stats.php",
        "line": 151,
        "snippet": "L137: $body = json_decode( wp_remote_retrieve_body( $response ) );  \u2192  L151: return maybe_unserialize( get_option( 'jetpack_protect_global_stats' ) );"
    },
    "explanation": "a remote HTTP fetch (`wp_remote_*`/`curl_exec`) is followed by `unserialize`/`maybe_unserialize` within the same file \u2014 classic PHP Object Injection C2 gadget used by EP and most WP supply-chain backdoors. Legit plugins essentially never do this."
}

{
    "slug": "jetpack",
    "previous_version": "15.7.1",
    "current_version": "15.7.1",
    "new_findings": [
        {
            "pattern": "unserialize_after_remote_call",
            "kind": "builtin",
            "file": "jetpack_vendor/automattic/jetpack-waf/src/class-waf-stats.php",
            "line": 151,
            "snippet": "L137: $body = json_decode( wp_remote_retrieve_body( $response ) );  \u2192  L151: return maybe_unserialize( get_option( 'jetpack_protect_global_stats' ) );",
            "confidence": "high"
        },
        {
            "pattern": "unserialize_after_remote_call",
            "kind": "builtin",
            "file": "json-endpoints/jetpack/class.jetpack-json-api-themes-install-endpoint.php",
            "line": 170,
            "snippet": "L169: $response   = wp_remote_post( $url, $args );  \u2192  L170: $theme_data = unserialize( $response['body'] ); // phpcs:ignore WordPress.PHP.Discourag",
            "confidence": "high"
        }
    ],
    "new_finding_count": 2
}