CrocoBLock JetEngine plugin suffers from an improper control of code generation flaw, allowing an attacker to inject and execute arbitrary PHP code. The vulnerability can lead to full compromise of the WordPress site, giving the attacker control over files, databases and potentially allowing data exfiltration or further lateral movement within the network. The weakness is specifically a CWE‑94 code injection vulnerability.

The affected product is the JetEngine plugin for WordPress by Crocoblock, versions from the earliest available release through 3.7.2 are impacted. Any WordPress installation that has this plugin installed and has not yet applied a fix is exposed.

The CVSS score of 8.5 indicates a high severity level, yet the EPSS score of less than 1% suggests the probability of widespread exploitation is currently low. The vulnerability is not listed in CISA’s KEV catalog, meaning there are no known publicly documented exploits at the time of this analysis. Based on the description, it is inferred that the most likely attack vector requires remote access to the WordPress site and exploitation of the plugin’s code generation mechanism, typically through crafted requests or actions performed by a user with sufficient permissions.