CVE-2026-28134

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28134", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-02-25T12:14:18.579Z", "datePublished": "2026-03-05T05:54:31.474Z", "dateUpdated": "2026-04-28T16:15:09.346Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://crocoblock.com", "defaultStatus": "unaffected", "packageName": "jet-engine", "product": "JetEngine", "vendor": "Crocoblock", "versions": [{"changes": [{"at": "3.8.1.2", "status": "unaffected"}], "lessThanOrEqual": "3.7.2", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "stealthcopter | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-28T13:51:55.131Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Control of Generation of Code ('Code Injection') vulnerability in Crocoblock JetEngine jet-engine allows Remote Code Inclusion.<p>This issue affects JetEngine: from n/a through <= 3.7.2.</p>"}], "value": "Improper Control of Generation of Code ('Code Injection') vulnerability in Crocoblock JetEngine jet-engine allows Remote Code Inclusion.This issue affects JetEngine: from n/a through <= 3.7.2."}], "impacts": [{"capecId": "CAPEC-253", "descriptions": [{"lang": "en", "value": "Remote Code Inclusion"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "description": "Improper Control of Generation of Code ('Code Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:15:09.346Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/jet-engine/vulnerability/wordpress-jetengine-plugin-3-7-2-remote-code-execution-rce-vulnerability?_s_id=cve"}], "title": "WordPress JetEngine plugin <= 3.7.2 - Remote Code Execution (RCE) vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-05T14:43:56.458105Z", "id": "CVE-2026-28134", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-28T13:38:38.659Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-28134", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-05T14:43:56.458105Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-05T14:43:06.048Z"}}], "cna": {"title": "WordPress JetEngine plugin <= 3.7.2 - Remote Code Execution (RCE) vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "stealthcopter | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-253", "descriptions": [{"lang": "en", "value": "Remote Code Inclusion"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Crocoblock", "product": "JetEngine", "versions": [{"status": "affected", "changes": [{"at": "3.8.1.2", "status": "unaffected"}], "version": "0", "versionType": "custom", "lessThanOrEqual": "3.7.2"}], "packageName": "jet-engine", "collectionURL": "https://crocoblock.com", "defaultStatus": "unaffected"}], "datePublic": "2026-04-28T13:51:55.131Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/jet-engine/vulnerability/wordpress-jetengine-plugin-3-7-2-remote-code-execution-rce-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Improper Control of Generation of Code ('Code Injection') vulnerability in Crocoblock JetEngine jet-engine allows Remote Code Inclusion.This issue affects JetEngine: from n/a through <= 3.7.2.", "supportingMedia": [{"type": "text/html", "value": "Improper Control of Generation of Code ('Code Injection') vulnerability in Crocoblock JetEngine jet-engine allows Remote Code Inclusion.<p>This issue affects JetEngine: from n/a through <= 3.7.2.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T12:10:56.675Z"}}}, "cveMetadata": {"cveId": "CVE-2026-28134", "state": "PUBLISHED", "dateUpdated": "2026-04-28T13:38:38.659Z", "dateReserved": "2026-02-25T12:14:18.579Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-03-05T05:54:31.474Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://crocoblock.com", "defaultStatus": "unaffected", "packageName": "jet-engine", "product": "JetEngine", "vendor": "Crocoblock", "versions": [{"changes": [{"at": "3.8.1.2", "status": "unaffected"}], "lessThanOrEqual": "3.7.2", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "audit@patchstack.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Control of Generation of Code ('Code Injection') vulnerability in Crocoblock JetEngine jet-engine allows Remote Code Inclusion.This issue affects JetEngine: from n/a through <= 3.7.2."}, {"lang": "es", "value": "La vulnerabilidad de 'Control inadecuado de la generaci\u00f3n de c\u00f3digo' ('Inyecci\u00f3n de c\u00f3digo') en Crocoblock JetEngine jet-engine permite la inclusi\u00f3n remota de c\u00f3digo. Este problema afecta a JetEngine: desde n/a hasta &lt;= 3.7.2."}], "id": "CVE-2026-28134", "lastModified": "2026-06-17T10:28:18.607", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 6.0, "source": "audit@patchstack.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28134", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-05T14:43:56.458105Z", "version": "2.0.3"}}]}, "published": "2026-03-05T06:16:48.197", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/jet-engine/vulnerability/wordpress-jetengine-plugin-3-7-2-remote-code-execution-rce-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.7.2]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "JetEngine", "source": "cna", "vendor": "Crocoblock"}, "product": "jetengine", "vendor": "crocoblock"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-16T04:46:10.930042+00:00", "value": {"mitigation_remediation": ["Upgrade JetEngine to the latest stable release that contains the fix for this code injection flaw", "If an immediate upgrade is not feasible, deactivate the JetEngine plugin or restrict its use to trusted administrators until the patch can be applied", "Audit any code that relies on JetEngine\u2019s dynamic code features to ensure proper validation and sanitization of input data"], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The affected product is the JetEngine plugin for WordPress by Crocoblock, versions from the earliest available release through 3.7.2 are impacted. Any WordPress installation that has this plugin installed and has not yet applied a fix is exposed.", "description_and_impact": "CrocoBLock JetEngine plugin suffers from an improper control of code generation flaw, allowing an attacker to inject and execute arbitrary PHP code. The vulnerability can lead to full compromise of the WordPress site, giving the attacker control over files, databases and potentially allowing data exfiltration or further lateral movement within the network. The weakness is specifically a CWE\u201194 code injection vulnerability.", "risk_and_exploitability": "The CVSS score of 8.5 indicates a high severity level, yet the EPSS score of less than 1% suggests the probability of widespread exploitation is currently low. The vulnerability is not listed in CISA\u2019s KEV catalog, meaning there are no known publicly documented exploits at the time of this analysis. Based on the description, it is inferred that the most likely attack vector requires remote access to the WordPress site and exploitation of the plugin\u2019s code generation mechanism, typically through crafted requests or actions performed by a user with sufficient permissions."}}}}, "created": "2026-03-06T15:08:09.806988+00:00", "updated": "2026-04-16T05:00:09.657484+00:00", "vendors": ["crocoblock", "crocoblock$PRODUCT$jetengine", "wordpress", "wordpress$PRODUCT$wordpress"]}