{"id":"CVE-2026-39735","kind":"vulnerability","aliases":["CVE-2026-39735"],"related":[],"title":"JetEngine WordPress plugin: missing authorization check exposes access-controlled content","description":"Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetEngine: from n/a through 3.9.0.1.","summary":"JetEngine, a WordPress plugin from Crocoblock, has a missing authorization check tied to access control configuration. The sources say an attacker can exploit incorrectly configured access control security levels to get around restrictions.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["crocoblock","jetengine","runtime","wordpress"],"not_affected_if":["access-control-unused","jetengine-not-installed"],"how_to_check":"- Check the installed JetEngine version in the WordPress plugins screen or the plugin header of `jet-engine`.\n- Compare the installed version against the range stated in the sources: affected through `3.9.0.1`.\n- Review which JetEngine access control settings are in use on the site.","fix":"- JetEngine: fixed release not stated in the sources; affected through `3.9.0.1`.","status":"open","published_at":"2026-10-29T13:17:11+00:00","first_seen_at":"2026-10-29T13:25:07+00:00","triaged_at":"2026-10-29T13:25:42+00:00","updated_at":"2026-10-29T13:25:42+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-29T13:25:42Z","model":"claude-haiku-5-5","output":{"fix":"- JetEngine: fixed release not stated in the sources; affected through `3.9.0.1`.","reach":"internet","title":"JetEngine WordPress plugin: missing authorization check exposes access-controlled content","impact":"medium","summary":"JetEngine, a WordPress plugin from Crocoblock, has a missing authorization check tied to access control configuration. The sources say an attacker can exploit incorrectly configured access control security levels to get around restrictions.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["wordpress","jetengine","crocoblock"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Restricted content or actions reachable by unauthorized users","analyst_note":"Confirm the fixed JetEngine version and the exact access control settings involved at https://nvd.nist.gov/vuln/detail/CVE-2026-39735.","how_to_check":"- Check the installed JetEngine version in the WordPress plugins screen or the plugin header of `jet-engine`.\n- Compare the installed version against the range stated in the sources: affected through `3.9.0.1`.\n- Review which JetEngine access control settings are in use on the site.","plain_action":"","needs_analyst":true,"not_affected_if":["jetengine-not-installed","access-control-unused"],"who_is_affected":"Sites running the JetEngine WordPress plugin up to and including 3.9.0.1 that use its access control security levels. The sources do not say which configurations are exposed by default, so sites that do not use JetEngine access control features are likely not affected. unknown beyond that.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000712,"input_tokens":4114,"output_tokens":601,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-39735':14A,17A '3.9.0.1':78C 'access':9A,35B,47B,68C 'access-control':8A 'affect':73C 'allow':64C 'around':53B 'attack':42B 'author':5A,31B,56C 'check':6A,32B 'configur':37B,46B,67C 'content':11A 'control':10A,36B,48B,69C 'crocoblock':18B,27B,59C 'cve':12A,15A 'engin':63C 'exploit':44B,65C 'expos':7A 'get':52B 'incorrect':45B,66C 'issu':72C 'jet':62C 'jet-engin':61C 'jetengin':1A,19B,22B,60C,74C 'level':50B 'levels.this':71C 'miss':4A,30B,55C 'n/a':76C 'plugin':3A,25B 'restrict':54B 'runtim':20B 'say':40B 'secur':49B,70C 'sourc':39B 'tie':33B 'vulner':57C 'wordpress':2A,21B,24B","nicknames":[],"mitigations":[],"who_affected":"Sites running the JetEngine WordPress plugin up to and including 3.9.0.1 that use its access control security levels. The sources do not say which configurations are exposed by default, so sites that do not use JetEngine access control features are likely not affected. unknown beyond that.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T13:17:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-39735","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39735","severity":null,"published_at":"2026-10-29T13:17:11+00:00","modified_at":"2026-10-29T13:17:11+00:00","first_seen_at":"2026-10-29T13:25:07+00:00","fetched_at":"2026-10-29T13:25:07+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}