The JetEngine WordPress plugin before 3.1.3.1 includes uploaded files without adequately ensuring that they are not executable, leading to a remote code execution vulnerability.
CVSS 3.1HIGH 8.8·Network·Low privileges·No interaction·EPSS 0.01519·Published 2023-04-10·Fixed in 3.1.3.1CWE-434