What is the CVSS score of CVE-2026-52706?

CVE-2026-52706 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of JetEngine are affected by CVE-2026-52706?

Crocoblock JetEngine, a commercial WordPress plugin, contains a critical vulnerability enabling unauthenticated remote attackers to completely compromise affected websites without authentication…

How to fix or mitigate CVE-2026-52706?

Within 24 hours: Execute asset discovery to identify all WordPress installations using Crocoblock JetEngine 3.8.10 and earlier; document exact versions and criticality ratings; deploy Web Application Firewall (WAF) rules to block PHP object injection and unsafe deserialization attempts; restrict WordPress admin panel access to VPN-authenticated networks with multi-factor authentication. Within 7 days: Complete business impact analysis on JetEngine criticality; immediately disable the plugin across non-critical environments; for critical deployments, implement file integrity monitoring on WordPress directories, enhanced audit logging, and network segmentation limiting plugin data access. Within 30 days: Establish daily monitoring of Crocoblock security advisories; maintain current offline backups; when Crocoblock releases a patched version, perform testing in isolated environment and schedule phased upgrades of all production installations.

JetEngine CVE-2026-52706

EUVD-2026-37628 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-06-17 Patchstack

PHP Deserialization Jetengine

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated PHP object injection reachable over the network with no user interaction; successful POP chain yields RCE in the web worker, giving full C/I/A impact within the WordPress scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:00 vuln.today

DescriptionCVE.org

Unauthenticated PHP Object Injection in JetEngine <= 3.8.10 versions.

AnalysisAI

Unauthenticated PHP Object Injection in Crocoblock JetEngine WordPress plugin versions 3.8.10 and earlier allows remote attackers to inject arbitrary PHP objects, potentially leading to full site compromise via gadget-chain abuse. The CVSS 9.8 score reflects network-reachable, no-authentication, no-interaction exploitation against a widely deployed commercial WordPress plugin. No public exploit identified at time of analysis, but the unsafe-deserialization class (CWE-502) historically yields fast weaponization once a usable POP chain is published.

Technical ContextAI

JetEngine is a commercial Crocoblock WordPress plugin used to build custom post types, meta fields, and dynamic content for Elementor-based sites, identified by CPE cpe:2.3:a:jetimpex_inc.:jetengine. The vulnerability is rooted in CWE-502 (Deserialization of Untrusted Data): user-controlled input reaches a PHP unserialize() call (or equivalent sink) without sufficient validation, allowing attacker-supplied serialized objects to be instantiated. Once an attacker controls object instantiation, PHP magic methods (__wakeup, __destruct, __toString) in JetEngine, WordPress core, or co-installed plugins can be chained into a POP (Property-Oriented Programming) gadget chain to achieve file write, SQL execution, or arbitrary code execution within the PHP worker.

RemediationAI

Patch available per vendor advisory; administrators should upgrade JetEngine to the latest release above 3.8.10 as published by Crocoblock and tracked at https://patchstack.com/database/wordpress/plugin/jet-engine/vulnerability/wordpress-jetengine-plugin-3-8-10-php-object-injection-vulnerability. As a compensating control until upgrade, deploy a WAF rule (Patchstack, Wordfence, or equivalent) to block requests containing serialized PHP payload patterns (e.g., 'O:', 'a:', 'C:') in JetEngine endpoints and AJAX actions, and temporarily deactivate JetEngine on high-value sites; note that deactivation will break dynamic content widgets and custom post types, and WAF signature rules may produce false positives on legitimate serialized data. If patching is not immediately possible, also remove or restrict any co-installed plugins known to provide PHP POP gadget chains (e.g., older Monolog or Guzzle bundled versions) to raise the bar for exploitation, accepting reduced functionality of those plugins.