What is the CVSS score of EUVD-2026-48079?

EUVD-2026-48079 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

JetEngine EUVD-2026-48079

| CVE-2026-65467 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-07-23 Patchstack

GHSA-xfxf-hvqm-h74g

WordPress SSRF Jetengine Wordpress Plugin Crocoblock Jetimpex Inc

4.9

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

4.9 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

4.9 MEDIUM

Contributor authentication required (PR:L), specific feature conditions needed (AC:H), server-side reach to internal systems justifies scope change and low C/I impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:25 vuln.today

DescriptionCVE.org

Contributor Server Side Request Forgery (SSRF) in JetEngine <= 3.8.11 versions.

AnalysisAI

Server-Side Request Forgery in JetEngine WordPress plugin versions up to and including 3.8.11 allows authenticated Contributors to induce the server to make outbound HTTP requests to attacker-controlled destinations, including internal network resources. The vulnerability carries a scope change (S:C in CVSS), meaning exploitation can reach systems beyond the WordPress host itself - such as cloud metadata endpoints or internal services. No public exploit or KEV listing has been identified at time of analysis, but the contributor-level entry bar and network attack vector make this a realistic insider or low-privilege post-authentication risk.

Technical ContextAI

JetEngine (CPE: cpe:2.3:a:crocoblock._jetimpex_inc.:jetengine:*:*:*:*:*:*:*:*) is a feature-rich WordPress plugin by Crocoblock (JetImpex Inc.) that enables dynamic content, custom post types, and listing grids. CWE-918 (Server-Side Request Forgery) describes the root cause: a plugin function that accepts user-supplied URL or endpoint input and issues HTTP requests from the server without sufficient origin or scheme validation. Because the request originates server-side, it can bypass perimeter firewalls and reach resources on the internal network or loopback interface invisible to the client browser. The CVSS scope change (S:C) is consistent with this - the vulnerable WordPress application becomes a proxy that can interact with systems outside its intended security boundary, such as AWS/GCP/Azure instance metadata services (169.254.169.254), internal APIs, or adjacent containerized services.

RemediationAI

Update JetEngine to a version above 3.8.11 as soon as a patched release is confirmed; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/jet-engine/vulnerability/wordpress-jetengine-plugin-3-8-11-server-side-request-forgery-ssrf-vulnerability for the confirmed fix version once published. Note that the exact patched version number is not independently confirmed from the available input data - treat the Patchstack advisory as the authoritative source. If immediate patching is not feasible, restrict Contributor-level user registration and audit existing Contributor accounts, as this removes the low-privilege entry point. As a compensating control, configure an egress firewall or web application firewall rule to block outbound HTTP/HTTPS connections from the web server process to RFC-1918 address ranges and cloud metadata IP addresses (169.254.169.254, fd00:ec2::254), which limits the lateral reachability of any SSRF without disabling the plugin. Be aware that blocking egress traffic at the network layer may affect legitimate JetEngine dynamic data-fetch features depending on site configuration.