What is the CVSS score of CVE-2026-49075?

CVE-2026-49075 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of JetEngine are affected by CVE-2026-49075?

JetEngine WordPress plugin (versions through 3.8.9.1) contains a critical PHP Object Injection vulnerability (CVSS 9.8) enabling arbitrary code execution through gadget-chain attacks.

How to fix or mitigate CVE-2026-49075?

24 hours: Inventory all WordPress installations running JetEngine and identify current versions; prepare to disable the plugin if operational requirements allow. 7 days: Either remove JetEngine entirely or implement strict access controls limiting Contributor role assignments to essential personnel only; identify alternative plugins for any business-critical functionality. 30 days: Monitor Patchstack and JetEngine vendor advisories continuously for patch availability; establish expedited patching procedures for deployment upon vendor release.

JetEngine CVE-2026-49075

EUVD-2026-37617 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-06-17 Patchstack

PHP Deserialization Jetengine

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable WordPress endpoint with low attack complexity, but exploitation requires an authenticated Contributor account so PR:L not PR:N; deserialization typically yields full CIA impact via RCE.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:06 vuln.today

DescriptionCVE.org

Contributor PHP Object Injection in JetEngine <= 3.8.9.1 versions.

Articles & Coverage 1

News Critical PHP Object Injection in JetEngine WordPress Plugin - CVE-2026-49075 Jun 18, 2026

AnalysisAI

PHP Object Injection in the JetEngine WordPress plugin (versions through 3.8.9.1) allows authenticated users with the Contributor role to inject crafted serialized objects that are deserialized by the plugin, potentially leading to code execution or other gadget-chain abuse on the host site. The flaw, reported by Patchstack and tracked under CWE-502, requires only the low-privileged Contributor role rather than admin access, which significantly broadens the attacker pool on multi-author WordPress installations. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

JetEngine is a widely deployed WordPress plugin by Jetimpex/Crocoblock (CPE cpe:2.3:a:jetimpex_inc.:jetengine) used to build custom post types, meta fields, and dynamic content for Elementor-based sites. The root cause is CWE-502 (Deserialization of Untrusted Data): the plugin passes attacker-controlled input through a PHP unserialize() path without restricting allowed classes, so any object with a magic method (__wakeup, __destruct, __toString) reachable from loaded plugins/themes can be instantiated. When combined with a POP (Property-Oriented Programming) gadget chain - common in WordPress core, WooCommerce, or shared composer libraries - this typically escalates to file write, SSRF, or remote code execution.

RemediationAI

Upgrade JetEngine to a version newer than 3.8.9.1 as published by Crocoblock - the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/jet-engine/vulnerability/wordpress-jetengine-plugin-3-8-9-1-php-object-injection-vulnerability should be consulted for the exact fixed release, which was not independently confirmed in the supplied data (treat as 'Upstream fix expected per Patchstack advisory; released patched version not independently confirmed'). Until the patched version is installed, restrict who can hold the Contributor role and audit existing Contributor accounts, disable open user registration or force new registrations to the Subscriber role, and place the site behind a virtual-patching WAF such as Patchstack mU-plugin or Wordfence which typically ships rules for known JetEngine deserialization sinks; the trade-off is that WAF rules can break legitimate JetEngine form submissions and meta updates, so test in staging.