Crocoblock JetEngine CVE-2026-115608

Requires an authenticated account on a WordPress site running the Crocoblock JetEngine plugin at any version up to and including 3.9.0 (PR:L - a low-privilege authenticated user, exact required role not specified in the sources). No user interaction is needed (UI:N) and the attack is network-reachable (AV:N). The specific vulnerable feature, request parameter, or endpoint that carries the injectable input is not described in the available sources. Principal limiting factor: exploitation is gated by authentication, so sites that do not permit untrusted user registration or that restrict low-privilege accounts materially reduce exposure; sites with open/self-service registration are more exposed.

This is a genuine but second-tier priority rather than a drop-everything emergency, and the signals are mostly consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, base 8.5) describes a network-reachable, low-complexity SQL injection whose high score is driven by the changed scope and High confidentiality impact. The decisive limiter is PR:L: exploitation requires an authenticated account, so this is not mass-exploitable against anonymous visitors, and the Patchstack/vuln.today decision label is 'this_week' - not 'act_now' or 'emergency'. No EPSS score is provided in the input, so exploitation probability cannot be quantified. It is not listed in CISA KEV, and the only reference is the Patchstack advisory (no public exploit code or PoC reference is present). Net: treat as a priority patch on a near-term (this-week) schedule - the confidentiality exposure of the shared WordPress/MySQL database is serious - but the authentication requirement and absence of KEV/EPSS/PoC signals argue against widespread opportunistic exploitation at this time.

An attacker who holds a low-privileged authenticated account on a WordPress site running JetEngine ≤3.9.0 submits crafted input to a vulnerable plugin request parameter, causing injected SQL to execute against the site database. Because the CVSS scope is Changed with High confidentiality impact, the injection can read data beyond the plugin's own context - such as user records and secrets in the WordPress database. No public exploit code is identified at time of analysis, and the exact vulnerable endpoint is not described in the available sources.