CVE-2026-49075

Name of the Vulnerable Software and Affected Versions JetEngine versions prior to 3.8.9.2

Description The JetEngine plugin for WordPress allows authenticated attackers with contributor-level access and above to perform PHP Object Injection through the deserialization of untrusted input. PHP Object Injection occurs when an application deserializes data from an untrusted source, potentially allowing an attacker to manipulate the object's properties. While no POP chain (a sequence of gadgets used to achieve code execution) is present in the software itself, the presence of a POP chain in another installed plugin or theme could enable the deletion of arbitrary files, retrieval of sensitive data, or remote code execution.

Recommendations Update JetEngine to version 3.8.9.2 or later.