Deserialization of untrusted data in Crocoblock JetEngine allows code injection, enabling an attacker to execute arbitrary code on the affected WordPress installation. The flaw leads to a high impact Remote Code Execution vulnerability, potentially compromising confidentiality, integrity, and availability of the system. The weakness is represented by CWE-82, indicating improper handling of untrusted serialized data.

Crocoblock’s JetEngine plugin for WordPress is affected in all releases from the initial version through 3.7.0. Any WordPress site that has JetEngine installed at a version equal to or lower than 3.7.0 is vulnerable.

The CVSS score of 8.5 categorizes this flaw as high severity, while the EPSS score of less than 1% indicates a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote, involving the submission of crafted serialized data to JetEngine’s input handling endpoints. No additional exploitation prerequisites are indicated, suggesting that any user able to submit data processed by the plugin could potentially trigger code execution.