CVE-2026-66613

Unauthenticated remote code execution (RCE) vulnerability in JetEngine plugin versions up to and including 3.8.14. An attacker can execute arbitrary code on the server without logging in.

Risk includes full site takeover, data theft, malware installation, and further attacks. The attack can be performed remotely without authentication.

Immediately update JetEngine to a version newer than 3.8.14. Check logs for suspicious requests and consider temporarily disabling the plugin.