Summary
CVE-2026-52706 is a critical unauthenticated PHP Object Injection vulnerability (CWE-502: Deserialization of Untrusted Data) in the JetEngine WordPress plugin by Jetimpex Inc. (Crocoblock), affecting all versions up to and including 3.8.10. With a CVSS v3.1 base score of 9.8, the flaw requires no authentication or user interaction and is exploitable directly over the network, making every internet-exposed WordPress site running a vulnerable version of JetEngine a potential target. A patched version (3.8.10.1) has been released and immediate upgrade is strongly recommended.
Technical details
- Root cause: The vulnerability stems from improper handling of serialized PHP objects — specifically, the plugin deserializes untrusted, attacker-controlled input without adequate validation, a pattern classified under CWE-502 (Deserialization of Untrusted Data).
- Trigger conditions: No authentication is required. An unauthenticated remote attacker can send a crafted HTTP request to a vulnerable JetEngine endpoint to inject a malicious PHP object.
- Attack vector: Network-accessible; low attack complexity, no privileges required, no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N).
- Impact: Successful exploitation can enable code injection, SQL injection, path traversal, and denial of service. Where a suitable Property-Oriented Programming (POP) gadget chain is present in the WordPress environment, exploitation can escalate to Remote Code Execution (RCE), resulting in full confidentiality, integrity, and availability compromise (C:H/I:H/A:H).
Affected software
- JetEngine (WordPress plugin by Jetimpex Inc. / Crocoblock) — all versions <= 3.8.10
Severity
- CVSS v3.1 Base Score: 9.8 (Critical)
- Vector String:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Mitigation and recommended actions
- Immediate – Apply the vendor patch: Update JetEngine to version 3.8.10.1 or later. This is the vendor-released fix addressing the deserialization flaw.
- If patching is not immediately feasible: Restrict public HTTP access to WordPress plugin endpoints at the web server or WAF layer where operationally possible, and consider enabling a virtual patching / firewall rule via your WAF provider to block exploitation attempts until the plugin is updated.
- Audit for active exploitation: Review web server access logs for anomalous POST requests to JetEngine endpoints, particularly from unexpected source IPs, as a precaution given the zero-interaction nature of this vulnerability.
IONIX Status
The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

