CVE-2026-28134: 
WordPress vulnerability analysis and mitigation

CVE-2026-28134 is a code injection vulnerability (CWE-94) in the Crocoblock JetEngine WordPress plugin that allows authenticated attackers to perform Remote Code Inclusion. It affects JetEngine versions up to and including 3.7.2. The vulnerability was published on March 5, 2026, with the CVE assigned by Patchstack. It carries a CVSS v3.1 base score of 8.5 (High), as assessed by CISA-ADP (Patchstack, Feedly).

The vulnerability stems from improper control of code generation (CWE-94) within the JetEngine plugin's handling of user-supplied input, enabling Remote Code Inclusion. An authenticated attacker with low privileges can craft a malicious network request that causes the plugin to include and execute attacker-controlled code server-side. The attack vector is network-based, requires low privileges, no user interaction, and has a changed scope — meaning successful exploitation can impact resources beyond the vulnerable component itself. No public proof-of-concept code has been identified at this time (Patchstack, Feedly).

Successful exploitation allows an authenticated attacker to execute arbitrary code remotely on the affected WordPress server, resulting in complete compromise of confidentiality, integrity, and availability. An attacker could exfiltrate sensitive data, modify site content, install backdoors or web shells, and potentially pivot to other systems within the hosting environment. The changed scope in the CVSS vector indicates that the impact can extend beyond the JetEngine plugin itself to the broader WordPress installation and underlying server (Feedly).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation as of the time of reporting. The EPSS score is approximately 0.029% (0.000290), indicating a currently low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been made (Feedly).

The primary remediation is to update the JetEngine plugin to a version beyond 3.7.2 once a patched release is made available by Crocoblock. In the interim, administrators should restrict JetEngine functionality to trusted, privileged users only and audit existing user accounts with plugin-level access. If a patch is not immediately available, consider temporarily disabling or isolating the JetEngine plugin to reduce attack surface. Monitor JetEngine plugin activity and WordPress server logs for anomalous code execution or unexpected file inclusion events (Feedly, Patchstack).

Wordfence noted this vulnerability in their weekly WordPress vulnerability report covering the period of February 23 to March 1, 2026, highlighting it as part of a broader set of plugin-level risks (Wordfence Blog). The Hacker Wire published a dedicated article on the Remote Code Inclusion risk posed by this CVE (The Hacker Wire). Community coverage has been limited, consistent with the absence of active exploitation or a public PoC.