Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

JetEngine versions <= 3.8.14 allow unauthenticated code execution

CVE-2026-66613 · published 2 months ago
Summary

If you're using JetEngine, an attacker can run malicious code on your website without needing a password. This means they could potentially delete or alter your site's content, or even take control of your entire site. Update to version 3.8.15 or later to fix this issue.

What to do
  • Update crocoblock. jetimpex inc. jetengine to version 3.8.14.1.
Affected software
VendorProductAffected versions
crocoblock. jetimpex inc. jetengine <= 3.8.14
Fix: upgrade to 3.8.14.1
Original advisory text
WordPress JetEngine plugin <= 3.8.14 - Remote Code Execution (RCE) vulnerability
Unauthenticated Remote Code Execution (RCE) in JetEngine <= 3.8.14 versions.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-1336Improper Neutralization of Special Elements Used in a Template Engine
Timeline
Published19 Aug 2026
Updated29 Oct 2026
First seen19 Aug 2026
Sources
CVE-2026-66613 · NVD
CVE-2026-66613 · MITRE
Track software like this
Free during beta