CVE-2026-61977
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
The JetSearch WordPress plugin (versions up to 3.6.1.2) contains a vulnerability that allows unauthorized users to access sensitive system information. This flaw enables reading embedded sensitive data, potentially leading to information disclosure.
Risk Assessment
The organization is at risk of leaking confidential system data, which could be used for further attacks or information theft. The vulnerability can be exploited remotely without authentication.
Recommendation
Immediately update the JetSearch plugin to version 3.6.2 or later, which includes a fix. If an update is not possible, temporarily disable the plugin until the patch is applied.
Other vulnerabilities in JetSearch
See all- CVE-2026-66577Medium
The JetSearch plugin in versions up to and including 3.6.3 is vulnerable to Cross Site Scripting (XSS). A user with Contributor privileges can inject a malicious script.
- CVE-2026-49079Critical
JetSearch versions up to 3.5.17 are vulnerable to unauthenticated SQL injection, potentially allowing unauthorized access to data.
Original NVD description (English source)
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetSearch jet-search allows Retrieve Embedded Sensitive Data.This issue affects JetSearch: from n/a through <= 3.6.1.2.