What is the CVSS score of CVE-2026-28134?

CVE-2026-28134 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Crocoblock JetEngine are affected by CVE-2026-28134?

A critical code injection vulnerability in Crocoblock JetEngine (versions ≤3.7.2) allows attackers to execute arbitrary code on affected WordPress installations.

How to fix or mitigate CVE-2026-28134?

Within 24 hours: Audit all WordPress installations for JetEngine plugin presence and version; isolate affected systems from production if feasible. Within 7 days: Implement WAF rules to block malicious payloads targeting JetEngine endpoints; disable JetEngine if business-critical; contact Crocoblock for patch timeline. Within 30 days: Migrate to patched version immediately upon availability; conduct forensic analysis for evidence of exploitation; review access logs for suspicious activity dating back 90 days.

Crocoblock JetEngine CVE-2026-28134

HIGH

Code Injection (CWE-94)

2026-03-05 audit@patchstack.com

Code Injection RCE

8.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.5

DescriptionCVE.org

Improper Control of Generation of Code ('Code Injection') vulnerability in Crocoblock JetEngine jet-engine allows Remote Code Inclusion.This issue affects JetEngine: from n/a through <= 3.7.2.

AnalysisAI

Remote code execution in Crocoblock JetEngine versions 3.7.2 and earlier allows authenticated attackers to execute arbitrary code through improper handling of code generation. An attacker with valid credentials can leverage this code injection vulnerability to achieve remote code inclusion and gain full control over affected WordPress installations. No patch is currently available, leaving all users of vulnerable JetEngine versions at risk.

Technical ContextAI

Classified as CWE-94 (Code Injection). Affects Crocoblock JetEngine jet-engine. Improper Control of Generation of Code ('Code Injection') vulnerability in Crocoblock JetEngine jet-engine allows Remote Code Inclusion.This issue affects JetEngine: from n/a through <= 3.7.2.