# CVE-2026-52706: Jetimpex JetEngine PHP Object Injection

Source: https://junglewise.ai/threats/cve-2026-52706-jetimpex-jetengine-php-object-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-17. Updated: 2026-06-20  
License: CC BY 4.0 with a link back

CVE-2026-52706 · Severity: critical · CVSS 9.8 · Published 2026-06-17

JetEngine is a popular WordPress plugin used for creating dynamic content and custom website structures. A critical security flaw allows unauthenticated attackers to inject malicious code into the website. If exploited, this could lead to a total takeover of the site, theft of customer data, or a complete service outage.

Technologies: [Crocoblock JetEngine](https://junglewise.ai/threats/technologies/jetengine). Vendors: [Crocoblock](https://junglewise.ai/threats/vendors/crocoblock).

## Quick answers

**Is CVE-2026-52706 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-52706 being exploited in the wild.

**How severe is CVE-2026-52706?** Critical severity, with a CVSS score of 9.8, published 17 June 2026.

**Which products and versions are affected?** Crocoblock JetEngine <= 3.8.10.

**Is there a fix for CVE-2026-52706?** A patch was published on 2026-06-17: Patch confirmed available in version 3.8.10.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-52706 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-52706?** Check whether you run Crocoblock JetEngine at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A PHP Object Injection vulnerability exists in the JetEngine plugin for WordPress due to the insecure deserialization of user-supplied data. An unauthenticated remote attacker can exploit this by sending specially crafted input to the application. If a suitable Property-Oriented Programming (POP) chain is present on the server, the attacker can achieve remote code execution, SQL injection, or file system traversal. The vulnerability is fixed in version 3.8.10.1.

## Affected products

- Jetimpex Inc. JetEngine <= 3.8.10

## Timeline

- 2026-06-08: other: Reported by researcher VanTastic
- 2026-06-12: advisory: Patchstack advisory published
- 2026-06-17: disclosed: NVD publication date
- 2026-06-17: patched: Patch confirmed available in version 3.8.10.1

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/jet-engine/vulnerability/wordpress-jetengine-plugin-3-8-10-php-object-injection-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/jet-engine/vulnerability/wordpress-jetengine-plugin-3-8-10-php-object-injection-vulnerability?_s_id=cve)

## Related threats

- [Crocoblock JetEngine stored cross-site scripting](https://junglewise.ai/threats/cve-2026-125785-improper-neutralization-of-input-during-web-page-generation)
- [Crocoblock JetEngine stored cross-site scripting](https://junglewise.ai/threats/cve-2026-123477-improper-neutralization-of-input-during-web-page-generation)
- [Crocoblock JetEngine SQL injection](https://junglewise.ai/threats/cve-2026-39736-improper-neutralization-of-special-elements-used-in-an-sql)
- [Crocoblock JetEngine broken access control](https://junglewise.ai/threats/cve-2026-39735-missing-authorization-vulnerability-in-crocoblock-jetengine-jet)
- [Crocoblock JetEngine SQL injection vulnerability](https://junglewise.ai/threats/cve-2026-115608-improper-neutralization-of-special-elements-used-in-an-sql)