Crocoblock JetEngine Remote Code Execution Vulnerability

A code injection vulnerability allowing remote code execution has been identified in the Crocoblock JetEngine WordPress plugin, affecting versions through 3.7.2. This vulnerability arises from improper control over code generation, which could be exploited to include and execute malicious code on the server.

Impact

Exploitation of this vulnerability allows for remote code execution on the affected website, potentially leading to unauthorized access and full control over the site.

Remediation

Users of the Crocoblock JetEngine WordPress plugin should update to version 3.8.1.2 or later to address this vulnerability. Patchstack users can enable auto-update for vulnerable plugins.