CVE-2026-32355

A security flaw exists in JetEngine for WordPress versions prior to 3.8.4.1, allowing a contributor-level user and above to inject malicious PHP objects through unverified input deserialization. This vulnerability can only be exploited if another plugin or theme with a PHP Object Population (POP) chain is installed on the site, which would enable further actions such as deleting files, extracting sensitive information, or running code, depending on the specific POP chain in place.

Based on public CVE data (MITRE/NVD).