The vulnerability is a missing authorization flaw in the Crocoblock JetEngine plugin for WordPress versions up to 3.8.1.1. It allows an attacker to bypass role‑based access controls and perform operations that should be restricted, such as modifying content, creating or deleting database entries, or abusing plugin functionalities. The flaw is categorized as a broken access control weakness (CWE‑862).

Any WordPress site that has the Crocoblock JetEngine plugin installed with a version of 3.8.1.1 or earlier is affected. This includes all releases from the plugin’s inception through 3.8.1.1.

The EPSS score is below 1 %, indicating that the likelihood of current exploitation is low, and the vulnerability is not listed in CISA’s KEV catalog. The CVSS score of 4.3 indicates moderate severity. Nonetheless, the impact of an exploitation would be significant, providing an attacker with elevated privileges and the ability to manipulate or destroy site data. Exploitation would require the attacker to target the plugin’s endpoints, which lack proper authorization checks, and does not appear to require privileged credentials on the host.