Description

Unauthenticated Remote Code Execution (RCE) in JetEngine <= 3.8.14 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-19T13:17:50.563Z",
  "pubdate": "2026-08-19T13:17:50.563Z",
  "executiveSummary": "An unauthenticated Remote Code Execution (RCE) vulnerability exists in the JetEngine plugin for WordPress, affecting all versions up to and including version 3.8.14. This security flaw enables remote attackers to execute arbitrary system commands or PHP code on the underlying web server hosting the vulnerable WordPress installation without requiring prior authentication or administrative privileges. The vulnerability exposes the affected systems to severe operational risks, including total compromise of confidentiality, integrity, and availability. Successful exploitation allows threat actors to establish persistence, pivot into internal networks, exfiltrate sensitive database contents, or deploy secondary malware such as web shells and ransomware. The attack vector is exposed via network protocols over HTTP or HTTPS, requiring direct reachability to the WordPress application endpoints handled by the JetEngine plugin. Given the lack of authentication constraints and the critical nature of remote code execution, this vulnerability represents an imminent and high-severity risk to all organizations running unsupported or unpatched instances of JetEngine <= 3.8.14. Immediate remediation through version upgrading or temporary functional disablement is strongly advised to mitigate potential exploitation.",
  "technicalDetails": "The vulnerability resides within the JetEngine plugin, specifically affecting versions 3.8.14 and prior. The root cause stems from insecure handling and insufficient sanitization or validation of user-supplied input passed to dynamic request handlers or processing functions within the plugin's codebase. These functional components fail to adequately restrict execution contexts or validate authorization states before processing requests, allowing unauthenticated remote threat actors to supply malicious payloads.\nThe attack flow begins with an unauthenticated network request directed at the publicly accessible endpoints exposed by the JetEngine plugin over HTTP or HTTPS. An attacker crafts a specialized HTTP request containing serialized data, unsafe function calls, or malicious parameters designed to leverage the insecure input handling mechanism. Because the endpoint lacks authentication and privilege verification checks, the application processes the untrusted input directly within the context of the web server process.\nDuring execution, the vulnerable component interprets the malicious payload, leading to unsafe deserialization, dynamic code evaluation, or direct command execution depending on the specific internal handling logic of the affected function. The network exposure is broad, as the attack surface is exposed directly to the public internet on any standard WordPress deployment utilizing the vulnerable JetEngine plugin versions. No specialized privileges or session tokens are required to initiate the attack sequence, lowering the barrier to entry for automated exploitation scripts and targeted threat actors alike.\nThe post-exploitation impact is critical. Once arbitrary code execution is achieved, the attacker operates with the privileges of the web server user (such as www-data or apache). This enables the adversary to read configuration files containing database credentials, modify application source code, inject malicious administrative accounts into the WordPress database, deploy persistent web shells for stealthy access, and execute system binaries. Remediation requires updating the JetEngine plugin beyond the vulnerable version threshold where input sanitization and strict access control validations have been properly implemented."
}