CVE-2026-39735: WordPress JetEngine plugin <= 3.9.0.1 - Broken Access Control vulnerability

Q: Which JetEngine versions are affected?

The issue affects JetEngine versions through 3.9.0.1. The available data does not identify a fixed version.

Q: What access-control condition enables exploitation?

Exploitation involves incorrectly configured access-control security levels. The available information does not specify the required attacker privileges, affected feature, or whether default configurations are vulnerable.

Published Oct 29, 2026

Updated

Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetEngine: from n/a through 3.9.0.1.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress JetEngine plugin to a version that resolves this vulnerability.
Fixed in 3.9.0.2

Event History

Oct 29, 2026

CVE Published

via MITRE·12:58 PM

Data Sourced

via MITRE·12:58 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which JetEngine versions are affected?

The issue affects JetEngine versions through 3.9.0.1. The available data does not identify a fixed version.

What access-control condition enables exploitation?

Exploitation involves incorrectly configured access-control security levels. The available information does not specify the required attacker privileges, affected feature, or whether default configurations are vulnerable.

CVE-2026-39735: WordPress JetEngine plugin <= 3.9.0.1 - Broken Access Control vulnerability

Remediation

Event History

Frequently Asked Questions

Which JetEngine versions are affected?

What access-control condition enables exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which JetEngine versions are affected?

What access-control condition enables exploitation?