What is the CVSS score of CVE-2026-61976?

CVE-2026-61976 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

JetBlocks For Elementor CVE-2026-61976

EUVD-2026-43318 MEDIUM

Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497)

2026-07-13 Patchstack

WordPress Information Disclosure Wordpress Plugin Jetblocks For Elementor Crocoblock

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible with no authentication or user interaction; low confidentiality impact reflects partial system data disclosure with zero integrity or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:14 vuln.today

DescriptionCVE.org

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Retrieve Embedded Sensitive Data.This issue affects JetBlocks For Elementor: from n/a through <= 1.5.0.

AnalysisAI

Sensitive system information exposure in Crocoblock JetBlocks For Elementor (versions through 1.5.0) allows remote unauthenticated attackers to retrieve embedded sensitive data from affected WordPress installations. The flaw, classified under CWE-497, results in unauthorized disclosure of system-level information that should remain restricted to privileged contexts. No public exploit code or active exploitation has been identified at time of analysis, but the absence of authentication requirements lowers the barrier for opportunistic reconnaissance against any site running the vulnerable plugin version.

Technical ContextAI

JetBlocks For Elementor is a commercial WordPress plugin by Crocoblock that extends the Elementor page builder with custom header and footer block functionality. CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere) describes a class of vulnerability where an application unintentionally surfaces internal system details - such as server paths, configuration values, environment variables, or plugin metadata - to parties outside the intended trust boundary. The CPE string cpe:2.3:a:crocoblock:jetblocks_for_elementor:*:*:*:*:*:*:*:* confirms all releases from the initial version through 1.5.0 are affected. The Elementor plugin ecosystem context means the vulnerable code is typically exposed via WordPress REST API endpoints or frontend-rendered page templates, which are inherently network-accessible without authentication.

RemediationAI

The primary remediation is to update JetBlocks For Elementor to a version beyond 1.5.0 via the WordPress plugin repository or the Crocoblock account dashboard. The exact patched release version is not explicitly stated in the available data - verify the specific fixed version through the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/jet-blocks/vulnerability/wordpress-jetblocks-for-elementor-plugin-1-5-0-sensitive-data-exposure-vulnerability or the Crocoblock official changelog before upgrading. If an immediate patch cannot be applied, a compensating control is to deactivate the JetBlocks For Elementor plugin until the update can be scheduled; this eliminates exposure but removes associated header/footer block functionality. Restricting access to WordPress REST API endpoints via a web application firewall rule targeting jet-blocks plugin routes may reduce exposure surface, though the specific vulnerable endpoint is not identified in available data, so this trade-off carries uncertainty.