What is the CVSS score of CVE-2026-61977?

CVE-2026-61977 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

JetSearch CVE-2026-61977

EUVD-2026-43319 MEDIUM

Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497)

2026-07-13 Patchstack

WordPress Information Disclosure Wordpress Plugin Jetsearch Crocoblock

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable, no privileges needed, low confidentiality impact only; no integrity or availability effect per CWE-497 disclosure class.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:20 vuln.today

DescriptionCVE.org

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetSearch jet-search allows Retrieve Embedded Sensitive Data.This issue affects JetSearch: from n/a through <= 3.6.1.2.

AnalysisAI

Unauthenticated sensitive data exposure in Crocoblock JetSearch WordPress plugin (all versions through 3.6.1.2) permits remote attackers to retrieve embedded sensitive system information without any credentials or user interaction. The flaw is classified under CWE-497, indicating the plugin surfaces internal system data through an externally accessible vector. With a network-accessible, zero-privilege attack path confirmed by the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector, any internet-facing WordPress installation running a vulnerable JetSearch version is exposed. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

JetSearch (CPE: cpe:2.3:a:crocoblock:jetsearch:*:*:*:*:*:*:*:*) is a WordPress plugin developed by Crocoblock, designed to provide advanced search functionality for Elementor-based WordPress sites. CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere) identifies the root cause as the plugin inadvertently embedding or returning sensitive system data - such as server paths, configuration fragments, API keys, or internal metadata - within responses accessible to unauthenticated network requesters. This class of flaw typically arises when debug output, error messages, or internal data structures are included in plugin AJAX handlers or REST API endpoints without access control enforcement. The affected version range extends from the earliest available version through and including 3.6.1.2, as reported by Patchstack.

RemediationAI

Update JetSearch to the version released after 3.6.1.2 via the WordPress plugin dashboard or by downloading directly from the Crocoblock/WordPress plugin repository; the exact patched version number was not specified in the source data and should be verified against the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/jet-search/vulnerability/wordpress-jetsearch-plugin-3-6-1-2-sensitive-data-exposure-vulnerability before applying. If an update is not immediately available, a compensating control is to deactivate the JetSearch plugin entirely - this eliminates the attack surface at the cost of losing the plugin's search functionality. Alternatively, a web application firewall (WAF) rule blocking unauthenticated access to the plugin's AJAX or REST endpoints can limit exposure, though this approach requires identifying the specific vulnerable endpoint and may break legitimate plugin operation. Site administrators should also audit server logs for anomalous unauthenticated requests targeting JetSearch endpoints as an indicator of prior reconnaissance.