What is the CVSS score of CVE-2026-66613?

CVE-2026-66613 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of JetEngine are affected by CVE-2026-66613?

Crocoblock JetEngine WordPress plugin versions 3.8.14 and earlier contain a critical remote code execution vulnerability accessible to unauthenticated attackers, exposing all affected WordPress…

How to fix or mitigate CVE-2026-66613?

Within 24 hours: Inventory all WordPress installations running JetEngine version 3.8.14 or earlier across managed hosting and internal infrastructure. Within 7 days: Implement Web Application Firewall (WAF) rules to detect and block SSTI exploitation attempts targeting the plugin, restrict WordPress administrative access to authorized IP ranges only, and disable the JetEngine plugin if functionality permits. Within 30 days: Establish daily monitoring of Crocoblock security advisories for patch availability, evaluate alternative plugins to replace JetEngine, and develop a rapid deployment plan for any vendor patch when released.

JetEngine CVE-2026-66613

EUVD-2026-62375 CRITICAL

Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

2026-08-19 Patchstack

GHSA-wrpq-j7q3-24j7

WordPress RCE Ssti Jetengine Wordpress Plugin Crocoblock Jetimpex Inc

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network SSTI reaching a template sink with no user interaction (AV:N/AC:L/PR:N/UI:N) yields code execution with full confidentiality, integrity, and availability loss.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 19, 2026 - 13:29 vuln.today

CVE Published

Aug 19, 2026 - 12:38 cve.org

CRITICAL 9.8

DescriptionCVE.org

Unauthenticated Remote Code Execution (RCE) in JetEngine <= 3.8.14 versions.

AnalysisAI

Remote code execution in Crocoblock JetEngine (WordPress plugin) versions 3.8.14 and earlier allows unauthenticated attackers to run arbitrary code on the host, tagged by Patchstack as a server-side template injection (SSTI) issue. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N) reflecting network-reachable, no-privilege, no-interaction exploitation with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV; EPSS data was not provided.

Technical ContextAI

JetEngine is a Crocoblock plugin for WordPress used to build dynamic content, custom post types, listings, and templates, and it exposes a template/shortcode rendering layer. The root cause class is CWE-1336, improper neutralization of special elements used in a template engine (server-side template injection), consistent with the vendor tags 'Ssti' and 'RCE'. When attacker-controlled input reaches the template engine without proper sanitization, template directives are evaluated server-side, allowing the injected expression to escalate from string interpolation to arbitrary PHP/OS-level code execution. The single affected CPE is cpe:2.3:a:crocoblock._jetimpex_inc.:jetengine, confirming Crocoblock/Jetimpex as the vendor.

RemediationAI

No vendor-released patch version was identified in the provided data; the advisory only confirms that JetEngine 3.8.14 and earlier are vulnerable, so administrators should upgrade to the first Crocoblock release published after 3.8.14 as soon as it is available and consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/jet-engine/vulnerability/wordpress-jetengine-plugin-3-8-14-remote-code-execution-rce-vulnerability to confirm the exact fixed build. Until a patched version is applied, place the site behind a WAF with virtual-patching rules for SSTI/template-injection payloads (Patchstack provides such a rule), restrict or disable JetEngine features that render user-supplied template or shortcode input, and limit network access to endpoints that accept dynamic-template parameters - noting the trade-off that disabling dynamic-content rendering can break listings and templated pages that depend on JetEngine. Monitor web-server logs for template-syntax payloads and for unexpected PHP or shell processes spawned by the web server.