CVE-2026-52706: WordPress JetEngine plugin <= 3.8.10 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection is an unauthenticated remote code execution class of vulnerability affecting the JetEngine WordPress plugin at version 3.8.10 and below. An attacker can reach the vulnerable deserialization point directly over the network without any credentials or user interaction. Successful exploitation gives the attacker full control over confidentiality, integrity, and availability of the affected system, up to and including arbitrary code execution when a suitable PHP gadget chain is present. HarborGuard is tracking the upstream advisory and will make a patched-image rebuild available the moment a fix version is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, meaning an attacker can reach it from any internet-routable address without requiring a foothold on the host.

• AuthenticationNot required

  No account or session token of any privilege level is needed; the injection point is accessible to anonymous HTTP requests.

• Victim interactionNot required

  The attack is fully server-side and requires no action from any user or administrator to trigger deserialization.

• Attack complexityDetail

  Exploitation is reliable and condition-free once a PHP gadget chain is identified in the target environment; no race condition or special memory layout is required.

Blast Radius

• A successful attacker can execute arbitrary PHP code on the server, gaining full control of the WordPress application and its underlying host process.
• All data stored in the WordPress database, including user credentials, session tokens, and any customer records managed by JetEngine, is readable by the attacker.
• The attacker can modify or delete database rows, posts, plugin configuration, and any file writable by the web server process.
• The attacker can crash or make the affected service unavailable by corrupting application state or exhausting server resources.