CVE-2026-61975: JetReviews Information Disclosure Flaw

CVE-2026-61975 Overview

CVE-2026-61975 is a sensitive data exposure vulnerability affecting the Crocoblock JetReviews WordPress plugin (jet-reviews) in all versions up to and including 3.0.1. The flaw is classified under [CWE-497]: Exposure of Sensitive System Information to an Unauthorized Control Sphere. An unauthenticated remote attacker can retrieve embedded sensitive data from the plugin over the network without user interaction.

The vulnerability carries a CVSS 3.1 base score of 5.3 (Medium) and only impacts confidentiality. Patchstack published the advisory following coordinated disclosure with Crocoblock.

Critical Impact
Unauthenticated remote attackers can retrieve embedded sensitive data from vulnerable JetReviews installations, aiding reconnaissance and follow-on attacks against WordPress sites.

Affected Products

Crocoblock JetReviews (jet-reviews) WordPress plugin
All versions from initial release through 3.0.1
WordPress sites with the JetReviews plugin installed and activated

Discovery Timeline

2026-07-13 - CVE-2026-61975 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-61975

Vulnerability Analysis

CVE-2026-61975 stems from the JetReviews plugin exposing sensitive system or application data to unauthorized callers. The plugin returns embedded sensitive information through a network-accessible surface without enforcing an authentication or authorization boundary. Any remote user who can reach the WordPress site can trigger the disclosure.

The impact is limited to confidentiality. The vulnerability does not allow modification of data or disruption of service, but the disclosed information can support reconnaissance for privilege escalation, credential attacks, or targeting of other components in the WordPress stack.

Because the plugin is widely used within the Crocoblock ecosystem for JetEngine-driven WordPress sites, exposure is broad wherever the plugin is deployed with a version at or below 3.0.1.

Root Cause

The root cause is missing access control on a plugin code path that returns sensitive embedded data. The plugin fails to restrict the response to authenticated or authorized users, aligning with the [CWE-497] weakness pattern of exposing system information to an unauthorized control sphere.

Attack Vector

Exploitation requires only network access to the target WordPress site. No credentials and no user interaction are needed. An attacker issues a crafted HTTP request to the vulnerable JetReviews endpoint and parses the response for sensitive data. See the Patchstack Vulnerability Report for the technical writeup.

Detection Methods for CVE-2026-61975

Indicators of Compromise

Unauthenticated HTTP GET or POST requests to JetReviews plugin endpoints under /wp-content/plugins/jet-reviews/ or associated REST routes
Anomalous response sizes from JetReviews endpoints returning embedded configuration or system data
Repeated scanning patterns from a single source enumerating jet-reviews paths

Detection Strategies

Inventory all WordPress sites and identify installations of the JetReviews plugin at version 3.0.1 or earlier
Review web server access logs for unauthenticated requests targeting JetReviews endpoints with unusual query parameters
Deploy WAF rules that flag or block requests fingerprinting the JetReviews plugin from external sources

Monitoring Recommendations

Enable verbose HTTP access logging on WordPress hosts and forward logs to a centralized analytics platform
Alert on spikes in traffic to jet-reviews URIs from non-administrative IP ranges
Track WordPress plugin version drift so unpatched instances of JetReviews are surfaced promptly

How to Mitigate CVE-2026-61975

Immediate Actions Required

Update the Crocoblock JetReviews plugin to a version later than 3.0.1 once a fixed release is available from the vendor
If no patched version is yet installed, deactivate and remove the JetReviews plugin from production sites
Restrict external access to WordPress plugin endpoints using a web application firewall or reverse proxy allowlist

Patch Information

Refer to the Patchstack Vulnerability Report for the current patch status and vendor guidance. The advisory identifies affected versions as n/a through <= 3.0.1. Confirm the fixed version directly with Crocoblock before deploying.

Workarounds

Block or rate-limit unauthenticated requests to /wp-content/plugins/jet-reviews/ at the WAF or reverse proxy
Disable the JetReviews plugin on sites that do not actively use its review functionality
Rotate any credentials, API keys, or tokens that may have been exposed through vulnerable JetReviews responses

bash

# Example nginx snippet to block external access to the vulnerable plugin path
location ~* /wp-content/plugins/jet-reviews/ {
    allow 10.0.0.0/8;
    deny all;
}