CVE-2026-28134
Published: 05 March 2026
Summary
CVE-2026-28134 is a high-severity Code Injection (CWE-94) vulnerability. Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 18.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates CVE-2026-28134 by requiring timely installation of patches for the vulnerable JetEngine plugin versions up to 3.7.2.
Prevents remote code inclusion by enforcing validation of inputs to the JetEngine plugin, blocking malicious code injection as described in CWE-94.
Identifies the JetEngine code injection vulnerability through vulnerability scanning of WordPress plugins, enabling remediation before exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
RCE via code injection in public-facing WordPress plugin directly enables T1190 for initial access; arbitrary code execution maps to Unix shell interpreter (T1059.004); remote code inclusion facilitates web shell deployment (T1505.003).
NVD Description
Improper Control of Generation of Code ('Code Injection') vulnerability in Crocoblock JetEngine jet-engine allows Remote Code Inclusion.This issue affects JetEngine: from n/a through <= 3.7.2.
Deeper analysisAI
CVE-2026-28134 is an Improper Control of Generation of Code ('Code Injection') vulnerability in the Crocoblock JetEngine WordPress plugin (jet-engine) that allows Remote Code Inclusion. This issue affects JetEngine versions from n/a through 3.7.2 and has a CVSS v3.1 base score of 8.5 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H), mapped to CWE-94.
The vulnerability can be exploited by a low-privileged remote attacker (PR:L) over the network (AV:N) with high attack complexity (AC:H) and no user interaction (UI:N). Successful exploitation achieves high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) with changed scope (S:C), enabling remote code execution.
Patchstack has published an advisory detailing the vulnerability in the WordPress JetEngine plugin version 3.7.2, available at https://patchstack.com/database/Wordpress/Plugin/jet-engine/vulnerability/wordpress-jetengine-plugin-3-7-2-remote-code-execution-rce-vulnerability?_s_id=cve.
Details
- CWE(s)