CVE-2026-28134: Crocoblock JetEngine RCE Vulnerability

CVE-2026-28134 Overview

CVE-2026-28134 is a code injection vulnerability affecting the Crocoblock JetEngine WordPress plugin. This improper control of code generation flaw (CWE-94) enables authenticated attackers to achieve remote code inclusion, potentially leading to complete site compromise. The vulnerability exists in JetEngine versions through 3.7.2 and allows malicious actors with low-level privileges to execute arbitrary code on the target system.

Critical Impact

Authenticated attackers can exploit this code injection vulnerability to execute arbitrary code remotely, potentially gaining complete control over affected WordPress installations.

Affected Products

• Crocoblock JetEngine WordPress Plugin versions up to and including 3.7.2
• WordPress sites utilizing JetEngine for dynamic content generation
• Sites with authenticated users who have contributor-level or higher access

Discovery Timeline

• 2026-03-05 - CVE-2026-28134 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-28134

Vulnerability Analysis

This vulnerability stems from improper control of code generation within the JetEngine plugin's functionality. JetEngine is a popular WordPress plugin used for creating dynamic content, custom post types, and listing builders. The flaw allows attackers to inject and execute malicious code through the plugin's code generation mechanisms.

The vulnerability requires network access and authentication with low privileges, though the attack complexity is considered high. When successfully exploited, the impact extends beyond the vulnerable component itself (changed scope), affecting the confidentiality, integrity, and availability of the entire WordPress installation.

Root Cause

The root cause of CVE-2026-28134 lies in insufficient input validation and sanitization within JetEngine's code generation functionality. The plugin fails to properly control or filter user-supplied input before incorporating it into dynamically generated code, allowing attackers to inject malicious code that gets executed on the server.

This type of code injection vulnerability (CWE-94) occurs when an application constructs all or part of a code segment using externally-influenced input without properly neutralizing special elements that could modify the syntax or behavior of the intended code.

Attack Vector

The attack vector for this vulnerability is network-based, requiring an authenticated session with at least low-level privileges on the target WordPress installation. The exploitation flow typically involves:

1. An attacker authenticates to the WordPress site with minimal privileges (such as a subscriber or contributor role)
2. The attacker crafts a malicious request targeting JetEngine's vulnerable code generation functionality
3. The malicious payload bypasses insufficient input validation controls
4. The injected code is executed in the context of the web server, potentially with elevated privileges

The vulnerability enables remote code inclusion, meaning attackers can inject code from remote locations that then executes on the vulnerable server. For detailed technical information, see the Patchstack JetEngine RCE Vulnerability advisory.

Detection Methods for CVE-2026-28134

Indicators of Compromise

• Unexpected PHP files appearing in the WordPress uploads or plugin directories
• Unusual outbound network connections from the web server
• Modified JetEngine plugin files or new files in the jet-engine directory
• Suspicious entries in web server access logs targeting JetEngine endpoints
• Anomalous PHP execution patterns or process spawning from the web server

Detection Strategies

• Monitor WordPress plugin directories for unauthorized file modifications or new file creation
• Implement web application firewall (WAF) rules to detect code injection patterns in requests
• Review server access logs for suspicious POST requests to JetEngine-related endpoints
• Deploy file integrity monitoring (FIM) on the WordPress installation directory
• Analyze PHP execution logs for unusual code execution patterns

Monitoring Recommendations

• Configure alerts for new file creation in the wp-content/plugins/jet-engine/ directory
• Monitor web server error logs for PHP syntax errors that may indicate injection attempts
• Track authentication events and correlate with subsequent JetEngine API calls
• Implement network traffic analysis to detect unusual outbound connections from the web server

How to Mitigate CVE-2026-28134

Immediate Actions Required

• Update the JetEngine plugin to a patched version newer than 3.7.2 immediately
• Audit user accounts and remove unnecessary privileges from contributor and author roles
• Review WordPress site for signs of compromise before and after patching
• Implement a web application firewall (WAF) to provide an additional layer of protection
• Consider temporarily disabling JetEngine if an update is not immediately available

Patch Information

Crocoblock should release a security update addressing this vulnerability. WordPress administrators should update the JetEngine plugin through the WordPress admin dashboard or by downloading the latest version from the official source. Always verify plugin authenticity and back up your WordPress installation before applying updates.

For detailed patch and version information, consult the Patchstack security advisory.

Workarounds

• Restrict user registration and limit the creation of new accounts with authenticated access
• Implement IP-based access controls for WordPress admin and contributor areas
• Disable or limit JetEngine functionality that involves dynamic code generation
• Apply the principle of least privilege to all WordPress user accounts
• Use security plugins to add additional authentication requirements for plugin functionality

# Configuration example - Restrict access to WordPress admin via .htaccess
# Add to your WordPress .htaccess file to limit admin access by IP

<Files wp-login.php>
    Order Deny,Allow
    Deny from all
    # Allow specific trusted IP addresses
    Allow from 192.168.1.100
    Allow from 10.0.0.0/24
</Files>

# Block direct access to JetEngine includes directory
<Directory "/var/www/html/wp-content/plugins/jet-engine/includes/">
    Order Allow,Deny
    Deny from all
</Directory>