Unauthenticated Remote Code Execution in JetEngine Plugin

CVE-2026-66613 is a critical unauthenticated remote code execution vulnerability affecting JetEngine versions 3.8.14 and earlier, with a CVSS score of 9.8. This vulnerability allows attackers to execute arbitrary code on affected systems without requiring any authentication credentials. JetEngine is a popular WordPress plugin used for building dynamic content and forms, making this vulnerability particularly dangerous as it exposes thousands of websites to complete system compromise. The vulnerability stems from insufficient input validation and lacks proper security controls, enabling attackers to leverage the plugin's core functionality to achieve code execution.

While this CVE is not yet linked to specific MITRE ATT&CK techniques in public databases, Casky.ai's security skills use Claude's extended reasoning to identify related attack patterns and defensive capabilities. Practitioners using Casky would benefit from skills mapping to Execution techniques (T1059 - Command and Scripting Interpreter, T1190 - Exploit Public-Facing Application) and Initial Access vectors (T1190). Though Casky currently shows 0 directly matching skills for this CVE, the platform's approach enables security teams to understand the attack chain: reconnaissance of JetEngine installations, exploitation of the unauthenticated endpoint, and post-exploitation command execution. Practitioners would analyze logs for unusual requests to JetEngine endpoints, suspicious process execution following plugin interactions, and network indicators of outbound command-and-control communication—helping organizations detect compromise even before formal MITRE mappings emerge.