CVE-2026-49075: WordPress JetEngine plugin <= 3.8.9.1 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection vulnerability in the JetEngine WordPress plugin (versions 3.8.9.1 and earlier) allows an unauthenticated remote attacker to inject a malicious PHP object through unsanitized user input. The vulnerability is reachable over the network with no authentication required and no user interaction needed. Successful exploitation gives the attacker full control over confidentiality, integrity, and availability of the affected system, depending on what PHP classes are available in the application for the injected object to leverage. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the affected WordPress service over the network; no local or physical access is required.

• AuthenticationNot required

  No account or session credential of any kind is needed to trigger the vulnerability.

• Victim interactionNot required

  The attacker does not need to trick or involve any user to carry out the exploit.

• Attack complexityDetail

  Exploit conditions are reliable and free of environmental dependencies; no race conditions or special memory layout is required.

Blast Radius

• A successful attacker reads any data accessible to the web application process, including stored credentials, session tokens, and database contents.
• A successful attacker writes or modifies persisted data, including database rows, configuration files, and uploaded content.
• A successful attacker can crash or hang the web server process, taking the site offline.
• If a suitable gadget chain exists in the application's loaded PHP classes, the attacker gains remote code execution on the host running the WordPress installation.