JetSearch EUVD-2026-43319

No special conditions are required beyond the target WordPress site having the JetSearch plugin installed, active, and running a version at or below 3.6.1.2. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms remote unauthenticated exploitation against any network-reachable installation with no configuration prerequisites. Limiting factors include: (1) the plugin must be installed and activated - sites not using JetSearch are not affected; (2) impact is restricted to low-grade confidentiality loss with no integrity or availability consequences, reducing incentive for targeted attacks; (3) no user interaction is required, meaning exploitation does not depend on a victim performing any action.

The CVSS base score of 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N signals a low-complexity, unauthenticated network-accessible flaw, but with only partial confidentiality impact and no integrity or availability consequences. Real-world risk is moderate: the attack requires no authentication and no user interaction, making opportunistic scanning trivial, but the impact is bounded to low-grade information disclosure rather than code execution or data manipulation. No EPSS score was provided in the source data, so exploitation probability cannot be quantified. No KEV listing and no public exploit code have been identified, suggesting this is not currently under active widespread exploitation. The primary concern is that exposed sensitive data - depending on exactly what is disclosed - could serve as reconnaissance input for a chained attack (e.g., leaked paths enabling local file inclusion, or leaked keys enabling API abuse). CVSS signals and description are consistent with each other; no conflict to flag. The absence of a confirmed fixed version number in the provided data is a gap worth noting for patch verification.

An unauthenticated remote attacker sends a crafted HTTP request - likely targeting a WordPress AJAX endpoint or REST API route registered by JetSearch - to an internet-facing WordPress site running version 3.6.1.2 or earlier. The plugin processes the request without enforcing access controls and returns a response containing embedded sensitive system information such as internal file paths, configuration values, or similar metadata. No public exploit code has been identified at time of analysis, but the low attack complexity makes manual replication straightforward for a moderately skilled attacker.