CVE-2026-22356

HIGH

Jetpack CRM <=6.7.0 - PHP Local File Inclusion

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-22356. PoCs published by xxconi.

AI-analyzed exploit summary The repository provides a technical analysis of CVE-2026-22356, detailing a path traversal vulnerability in Jetpack CRM leading to RCE via log poisoning. It includes a code snippet demonstrating the vulnerability and explains the patch applied in version 6.7.1.

Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Automattic Jetpack CRM zero-bs-crm allows PHP Local File Inclusion.This issue affects Jetpack CRM: from n/a through <= 6.7.0.

Exploits (1)

github WRITEUP

by xxconi · poc

https://github.com/xxconi/CVE-2026-22356

View Code ZIP pw:eip

The repository provides a technical analysis of CVE-2026-22356, detailing a path traversal vulnerability in Jetpack CRM leading to RCE via log poisoning. It includes a code snippet demonstrating the vulnerability and explains the patch applied in version 6.7.1.

Classification

Writeup 90%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: Jetpack CRM (versions before 6.7.1)

No auth needed

Prerequisites: Access to a vulnerable Jetpack CRM instance · Ability to send crafted HTTP requests

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter T1203 - Exploitation for Client Execution

devstral-2 · analyzed Jun 13, 2026 Full analysis →

References (1)

Core 1

Core References

Third Party Advisory vdb-entry

https://patchstack.com/database/Wordpress/Plugin/zero-bs-crm/vulnerability/wordpress-jetpack-crm-plugin-6-7-0-local-file-inclusion-vulnerability?_s_id=cve

Scores

CVSS v3 7.5

EPSS 0.0042

EPSS Percentile 33.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-98

Status published

Products (2)

Automattic/Jetpack CRM < 6.7.0

Automattic/Jetpack CRM < <= 6.7.0

Published Feb 20, 2026

Tracked Since Feb 20, 2026