EUVD-2026-37625Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site with JetBlog ≤2.4.8
-
DeliverySend unauthenticated HTTP request to vulnerable endpoint
-
ExploitReceive sensitive data in response
-
ExecutionHarvest credentials or config from leaked data
-
ImpactUse information for follow-on account or site compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Hardware debug access restrictions
|
| Exploitation Conditions | Exploitation requires only that the target WordPress site has the JetBlog plugin installed and activated at version 2.4.8 or earlier and that the vulnerable plugin endpoint (an AJAX or REST handler exposed by JetBlog) is reachable over HTTP/HTTPS from the attacker - consistent with CVSS PR:N/UI:N/AC:L. Limiting factors: the site must actually have JetBlog enabled (a paid Crocoblock-family plugin, so prevalence is narrower than free plugins), the endpoint must not be blocked by an upstream WAF or access-control rule, and the value of the disclosed data depends on what content/configuration the affected site stores - sites with minimal sensitive content face lower practical impact than membership or commerce sites. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) describes a fully remote, unauthenticated, low-complexity attack with no user interaction and high confidentiality impact, which is a strong network-exposure signal and justifies the 7.5 base score. However, several real-world risk signals are missing or muted: there is no CISA KEV listing, no POC referenced in the available data, no EPSS score provided, and the only intelligence source is Patchstack's own advisory - so widespread automated exploitation is not yet evidenced. Practically, this is a priority patch for sites running JetBlog because the leaked data may include sensitive post/user/config information harvestable at scale, but it likely sits below RCE/auth-bypass class issues unless POC code emerges. The exact nature of the disclosed data is not specified in the description, so impact severity could range from low-value metadata to credentials/PII - defenders should verify with the Patchstack advisory. |
| Exploit ScenarioDerived | A remote attacker enumerates WordPress sites running JetBlog (e.g., via wp-content/plugins/jet-blog/ fingerprinting) and issues a single unauthenticated HTTP request to the vulnerable plugin endpoint, receiving sensitive data in the response without needing credentials, cookies, or user interaction. Because the attack is network-based and low-complexity, it is well-suited to mass scanning across WordPress hosts; no public POC is currently identified, but the Patchstack advisory provides enough detail for skilled researchers to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 17, 2026
Sensitive data exposure in the JetBlog WordPress plugin (versions 2.4.8 and earlier) allows remote unauthenticated attackers to retrieve confidential information from affected sites over the network with no user interaction. The flaw is reported by Patchstack with a CVSS 3.1 base score of 7.5 (high confidentiality impact only). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided in the input.
RemediationAI
Upgrade the JetBlog plugin to a version newer than 2.4.8 as published by Jetimpex/Crocoblock once available - patch availability per vendor advisory is implied by the Patchstack listing, but no exact fix version was independently confirmed in the input data, so administrators should consult the Patchstack entry at https://patchstack.com/database/wordpress/plugin/jet-blog/vulnerability/wordpress-jetblog-plugin-2-4-8-sensitive-data-exposure-vulnerability for the patched release number. As compensating controls until patching, restrict access to wp-admin/admin-ajax.php and the plugin's REST routes via a WAF rule or Patchstack/virtual-patching subscription, block unauthenticated requests to JetBlog AJAX actions at the edge (trade-off: may break legitimate front-end dynamic widgets), or temporarily deactivate the JetBlog plugin if its widgets are not business-critical (trade-off: loss of blog widget functionality on the site).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JetBlog (cpe:2.3:a:jetimpex_inc.:jetblog) is a commercial WordPress blog/content plugin developed by Jetimpex (the Crocoblock/JetPlugins family) that adds smart post listings, dynamic content widgets, and AJAX-driven blog modules to WordPress sites. The weakness is classified as CWE-1258 (Exposure of Sensitive System Information Due to Uncleared Debug Information in Hardware/Software Registers), which in the context of a PHP WordPress plugin typically manifests as plugin endpoints, AJAX handlers, or REST routes that return internal state, configuration, or post data without authorization checks - effectively leaking information that should require an authenticated session. Patchstack categorizes the issue as Information Disclosure, consistent with the CVSS vector showing C:H/I:N/A:N.
Know when Jetblog gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network-reachable WordPress plugin endpoint leaks data with no UI; confidentiality high, no integrity or availability impact, no scope change.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Sensitive Data Exposure in JetBlog <= 2.4.8 versions.
Executive ViewAI
The JetBlog WordPress plugin (versions 2.4.8 and earlier) contains a data exposure vulnerability enabling unauthorized remote access to sensitive information without authentication. The vendor has not released a patch, creating immediate operational risk for affected organizations. Rapid remediation through plugin removal or isolation is required to prevent potential data breach exposure.
Disable or remove the plugin immediately. If removal is operationally infeasible, implement Web Application Firewall (WAF) rules to block exploitation attempts targeting the vulnerability. Restrict WordPress administrative access via IP allowlisting. Audit and isolate sensitive data exposure pathways. Monitor web server logs for unauthorized data access. No vendor-released patch identified at time of analysis.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Reflected cross-site scripting in Crocoblock's JetBlog WordPress plugin (all versions through 2.4.10) lets unauthenticat
Stored cross-site scripting in the JetBlog WordPress plugin through version 2.4.10 lets an attacker holding a Contributo
GitHub PoC
Exploit-DB