# CVE-2026-61977: Crocoblock JetSearch sensitive information disclosure in jet-search

Source: https://junglewise.ai/threats/cve-2026-61977-crocoblock-jetsearch-sensitive-information-disclosure-in-jet  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-13. Updated: 2026-07-13  
License: CC BY 4.0 with a link back

CVE-2026-61977 · Severity: medium · CVSS 5.3 · Published 2026-07-13

Crocoblock JetSearch is a WordPress plugin used to create advanced search functionality for websites. A security vulnerability in this plugin allows unauthorized individuals to access sensitive system information that should be protected. This could lead to the exposure of internal site data, potentially aiding attackers in further compromising the website or its users.

Technologies: [Crocoblock JetSearch](https://junglewise.ai/threats/technologies/jetsearch). Vendors: [Crocoblock](https://junglewise.ai/threats/vendors/crocoblock).

## Quick answers

**Is CVE-2026-61977 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61977 being exploited in the wild.

**How severe is CVE-2026-61977?** Medium severity, with a CVSS score of 5.3, published 13 July 2026.

**Which products and versions are affected?** Crocoblock JetSearch <= 3.6.1.2.

**Is there a fix for CVE-2026-61977?** A patch was published on 3.6.1.3: Vulnerability addressed in version 3.6.1.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-61977 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-61977?** Check whether you run Crocoblock JetSearch at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere) exists in the Crocoblock JetSearch plugin for WordPress. The flaw allows an unauthenticated remote attacker to retrieve embedded sensitive system data due to improper access controls within the 'jet-search' component. The issue affects all versions up to and including 3.6.1.2. A fix is available in version 3.6.1.3. The attack can be carried out over the network without user interaction.

## Affected products

- Crocoblock JetSearch <= 3.6.1.2

## Timeline

- 2026-07-13: advisory: Advisory published by Patchstack and NVD
- 3.6.1.3: patched: Vulnerability addressed in version 3.6.1.3

## References

- [https://crocoblock.com/](https://crocoblock.com/)
- [https://patchstack.com/database/Wordpress/Plugin/jet-search/vulnerability/wordpress-jetsearch-plugin-3-6-1-2-sensitive-data-exposure-vulnerability?_s_id=cve](https://patchstack.com/database/Wordpress/Plugin/jet-search/vulnerability/wordpress-jetsearch-plugin-3-6-1-2-sensitive-data-exposure-vulnerability?_s_id=cve)

## Related threats

- [Crocoblock JetSearch cross-site scripting in contributor panel](https://junglewise.ai/threats/cve-2026-66577-crocoblock-jetsearch-cross-site-scripting-in-contributor-panel)
- [Jetimpex JetSearch SQL injection in WordPress plugin](https://junglewise.ai/threats/cve-2026-49079-jetimpex-jetsearch-sql-injection-in-wordpress-plugin)