CVE-2026-49075: JetEngine PHP Object Injection Vulnerability

CVE-2026-49075 Overview

CVE-2026-49075 is a PHP Object Injection vulnerability affecting the JetEngine plugin for WordPress in versions up to and including 3.8.9.1. The flaw is rooted in insecure deserialization of untrusted data [CWE-502]. An authenticated user with Contributor-level privileges can supply a crafted serialized payload that the plugin processes through PHP's unserialize() function. When suitable gadget chains exist in the WordPress runtime, this leads to arbitrary code execution, file manipulation, or full site takeover. The vulnerability is exposed over the network and requires no user interaction beyond the attacker's authenticated session.

Critical Impact
Authenticated Contributors can trigger PHP object instantiation that leads to remote code execution, privilege escalation, and full compromise of the WordPress site.

Affected Products

Crocoblock JetEngine plugin for WordPress, versions <= 3.8.9.1
WordPress installations running JetEngine with Contributor accounts enabled
Multi-author WordPress sites using JetEngine for dynamic content

Discovery Timeline

2026-06-17 - CVE-2026-49075 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-49075

Vulnerability Analysis

The vulnerability is an insecure deserialization issue in JetEngine. The plugin passes attacker-controlled input into PHP's unserialize() routine without first validating that the data is safe. PHP deserialization reconstructs arbitrary object graphs and invokes magic methods such as __wakeup, __destruct, and __toString during the process. When the WordPress core or another installed plugin defines classes with exploitable magic methods, an attacker chains those methods into a property-oriented programming (POP) gadget chain. The result is arbitrary code execution, file write, or SQL execution in the context of the web server.

Root Cause

The root cause is the use of unserialize() on user-supplied input without enforcing an allowed_classes allowlist or switching to a safe format such as JSON. The Contributor role can submit content fields that flow into vulnerable deserialization sinks within JetEngine handlers prior to version 3.8.9.2.

Attack Vector

An attacker first authenticates to WordPress with any Contributor account, which is commonly available on multi-author sites or where registration is permitted. The attacker submits a crafted serialized PHP payload through a JetEngine input field or REST endpoint. JetEngine deserializes the payload, instantiating attacker-chosen classes and executing their magic methods. The resulting gadget chain can write webshells to disk, exfiltrate the WordPress secret keys from wp-config.php, or escalate the attacker to administrator. See the Patchstack WordPress Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-49075

Indicators of Compromise

POST requests from Contributor accounts containing serialized PHP markers such as O:, a:, or s: in body parameters processed by JetEngine.
New or modified PHP files in wp-content/uploads/, wp-content/plugins/, or wp-content/themes/ directories shortly after JetEngine requests.
Unexpected outbound connections from the web server process to attacker-controlled hosts after JetEngine activity.
Creation of new administrator accounts or modification of the wp_users and wp_usermeta tables without a corresponding admin session.

Detection Strategies

Inspect web server and WordPress logs for serialized object signatures in request bodies routed to JetEngine endpoints.
Hunt for PHP error logs containing references to __wakeup, __destruct, or class instantiation failures within JetEngine code paths.
Compare plugin file hashes against the official JetEngine distribution to identify tampering or webshell drop.

Monitoring Recommendations

Enable WordPress audit logging for content submission, user role changes, and option updates by Contributor accounts.
Forward web server, PHP-FPM, and WordPress logs to a centralized analytics platform and alert on serialized payload patterns.
Monitor file integrity in wp-content/ and the WordPress root with a host-based agent and review changes daily.

How to Mitigate CVE-2026-49075

Immediate Actions Required

Update the JetEngine plugin to the version released after 3.8.9.1 that addresses CVE-2026-49075.
Audit Contributor and higher-privileged accounts and disable any that are inactive or unrecognized.
Rotate WordPress secret keys in wp-config.php and reset passwords for all administrative users.
Review wp-content/uploads/ and plugin directories for unauthorized PHP files and remove any webshells.

Patch Information

Crocoblock has released a fixed JetEngine version following 3.8.9.1. Apply the update through the WordPress plugin manager or by replacing the plugin files manually. Confirm the installed version via the WordPress admin Plugins page or by checking the Version header in jet-engine.php. Refer to the Patchstack WordPress Vulnerability Report for vendor-confirmed fixed version details.

Workarounds

Restrict the Contributor role from accessing JetEngine forms and dynamic field submission until the patch is applied.
Place a web application firewall rule in front of the site that blocks request bodies matching PHP serialized object patterns such as O:\d+:".
Disable the JetEngine plugin entirely on sites where patching cannot be performed immediately.

bash

# Example WAF rule (ModSecurity) to block PHP serialized payloads to WordPress endpoints
SecRule REQUEST_URI "@beginsWith /wp-" \
  "chain,phase:2,deny,status:403,id:1049075,\
   msg:'Potential PHP Object Injection (CVE-2026-49075)'"
SecRule ARGS|REQUEST_BODY "@rx O:[0-9]+:\"[A-Za-z_\\\\]+\":[0-9]+:\{" \
  "t:none"