What is the CVSS score of EUVD-2026-37625?

EUVD-2026-37625 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of JetBlog are affected by EUVD-2026-37625?

The JetBlog WordPress plugin (versions 2.4.8 and earlier) contains a data exposure vulnerability enabling unauthorized remote access to sensitive information without authentication.

How to fix or mitigate EUVD-2026-37625?

Within 24 hours: Identify all WordPress installations running JetBlog plugin versions 2.4.8 and earlier through automated scanning or manual audit. Within 7 days: Disable or remove the JetBlog plugin; deploy alternative plugins for required functionality and verify removal across all instances. Within 30 days: Monitor Patchstack security advisories and vendor releases for security updates; implement compensating controls for any retained instances.

JetBlog EUVD-2026-37625

| CVE-2026-52696 HIGH

Exposure of Sensitive System Information Due to Uncleared Debug Information (CWE-1258)

2026-06-17 Patchstack

WordPress Information Disclosure Wordpress Plugin Jetblog Jetimpex Inc

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network-reachable WordPress plugin endpoint leaks data with no UI; confidentiality high, no integrity or availability impact, no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:01 vuln.today

DescriptionCVE.org

Unauthenticated Sensitive Data Exposure in JetBlog <= 2.4.8 versions.

AnalysisAI

Sensitive data exposure in the JetBlog WordPress plugin (versions 2.4.8 and earlier) allows remote unauthenticated attackers to retrieve confidential information from affected sites over the network with no user interaction. The flaw is reported by Patchstack with a CVSS 3.1 base score of 7.5 (high confidentiality impact only). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided in the input.

Technical ContextAI

JetBlog (cpe:2.3:a:jetimpex_inc.:jetblog) is a commercial WordPress blog/content plugin developed by Jetimpex (the Crocoblock/JetPlugins family) that adds smart post listings, dynamic content widgets, and AJAX-driven blog modules to WordPress sites. The weakness is classified as CWE-1258 (Exposure of Sensitive System Information Due to Uncleared Debug Information in Hardware/Software Registers), which in the context of a PHP WordPress plugin typically manifests as plugin endpoints, AJAX handlers, or REST routes that return internal state, configuration, or post data without authorization checks - effectively leaking information that should require an authenticated session. Patchstack categorizes the issue as Information Disclosure, consistent with the CVSS vector showing C:H/I:N/A:N.

RemediationAI

Upgrade the JetBlog plugin to a version newer than 2.4.8 as published by Jetimpex/Crocoblock once available - patch availability per vendor advisory is implied by the Patchstack listing, but no exact fix version was independently confirmed in the input data, so administrators should consult the Patchstack entry at https://patchstack.com/database/wordpress/plugin/jet-blog/vulnerability/wordpress-jetblog-plugin-2-4-8-sensitive-data-exposure-vulnerability for the patched release number. As compensating controls until patching, restrict access to wp-admin/admin-ajax.php and the plugin's REST routes via a WAF rule or Patchstack/virtual-patching subscription, block unauthenticated requests to JetBlog AJAX actions at the edge (trade-off: may break legitimate front-end dynamic widgets), or temporarily deactivate the JetBlog plugin if its widgets are not business-critical (trade-off: loss of blog widget functionality on the site).