Code Injection Vulnerability in Crocoblock JetEngine Plugin
CVE-2026-28134

8.5HIGH

Key Information:

Vendor

WordPress
Status
Jetengine
Vendor
CVE Published:
5 March 2026

What is CVE-2026-28134?

An improper control of code generation vulnerability has been identified in the Crocoblock JetEngine plugin, allowing attackers to execute remote code inclusion. This issue impacts versions up to 3.7.2, posing significant risks for WordPress sites utilizing the plugin. When exploited, this vulnerability can enable malicious user-controlled code to be executed on the server, leading to unauthorized access and potential compromise of the entire web application.

Affected Version(s)

JetEngine 0 <= 3.7.2

References

https://patchstack.com/database/Wordpress/Plugin/jet-engi...
vdb-entry

CVSS V3.1

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

stealthcopter | Patchstack Bug Bounty Program
.