What is the CVSS score of CVE-2026-61975?

CVE-2026-61975 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

JetReviews CVE-2026-61975

Q: Which versions of JetReviews are affected by CVE-2026-61975?

JetReviews WordPress plugin by Crocoblock (versions through 3.0.1) exposes embedded sensitive system information to unauthenticated remote attackers, classified under CWE-497.

EUVD-2026-43441 MEDIUM

Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497)

2026-07-13 Patchstack

WordPress Information Disclosure Wordpress Plugin Jetreviews Crocoblock

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible plugin endpoint leaks data with no authentication required; impact limited to partial confidentiality only, no integrity or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:14 vuln.today

DescriptionCVE.org

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetReviews jet-reviews allows Retrieve Embedded Sensitive Data.This issue affects JetReviews: from n/a through <= 3.0.1.

AnalysisAI

JetReviews WordPress plugin by Crocoblock (versions through 3.0.1) exposes embedded sensitive system information to unauthenticated remote attackers, classified under CWE-497. The vulnerability permits retrieval of sensitive data that should remain internal to the application - likely API keys, configuration values, or credentials embedded in plugin output or REST endpoints - without requiring any authentication, user interaction, or elevated privileges. No public exploit code or CISA KEV listing exists at time of analysis, but the zero-friction CVSS vector (AV:N/AC:L/PR:N/UI:N) means any internet-facing WordPress site running this plugin version is passively exposed.

Technical ContextAI

JetReviews is a WordPress plugin by Crocoblock (CPE: cpe:2.3:a:crocoblock:jetreviews:*:*:*:*:*:*:*:*) that provides review and rating functionality for WordPress sites, commonly used with Elementor-based themes. CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere) describes a class of flaw where internal system data - such as configuration parameters, API keys, or credentials - is embedded in application output (e.g., HTML source, REST API responses, or AJAX handlers) and accessible to parties who should not be able to retrieve it. In WordPress plugins, this commonly manifests through improperly secured REST API endpoints or shortcode rendering that leaks configuration data into front-end output. The affected version range is n/a through 3.0.1 per NVD and Patchstack reporting.

RemediationAI

Update JetReviews to a version beyond 3.0.1 as soon as it becomes available via the WordPress plugin repository or Crocoblock's distribution channel. Consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/jet-reviews/vulnerability/wordpress-jetreviews-plugin-3-0-1-sensitive-data-exposure-vulnerability for the confirmed patched version number, which was not independently specified in the available input data. If an immediate update is not possible, consider temporarily deactivating the JetReviews plugin - note this will remove review display functionality from the affected site, which may impact user experience. Additionally, audit any API keys, credentials, or sensitive configuration values that may have been embedded in plugin output, and rotate them as a precaution if exposure is suspected. Restrict public access to WordPress REST API routes associated with the plugin using firewall rules or a WAF rule targeting jet-reviews endpoints if deactivation is not feasible.