EUVD-2026-37552Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network-reachable AJAX endpoint with no user interaction; blind SQLi yields high confidentiality via data exfiltration but no inherent write or DoS impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
The JetEngine plugin for WordPress is vulnerable to SQL injection in all versions up to and including 3.8.10.1. The listing_load_more AJAX handler accepts a filtered_query parameter that is intentionally excluded from the HMAC query signature check to support front-end filter integration. However, meta_query row values within filtered_query are not sanitized before being merged into SQL construction. This makes it possible for unauthenticated attackers to perform time-based or boolean blind SQL injection by appending a malicious meta_query value to a Load More AJAX request captured from any public Listing Grid page.
AnalysisAI
Unauthenticated SQL injection in the JetEngine WordPress plugin versions up to 3.8.10.1 allows remote attackers to extract database contents via the listing_load_more AJAX handler. The filtered_query parameter is deliberately excluded from the HMAC signature check to enable front-end filter integration, but meta_query row values are merged into SQL without sanitization, enabling time-based or boolean blind injection. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Target site must run the JetEngine plugin at version 3.8.10.1 or earlier with at least one publicly reachable page containing a Listing Grid that exposes the listing_load_more AJAX action; no authentication, user interaction, or non-default configuration is required because the filtered_query parameter is intentionally whitelisted out of the HMAC signature check to support front-end filters. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5 High) is consistent with the description - exploitation is over the network, against a default AJAX endpoint on any public Listing Grid page, requires no authentication or user interaction, and yields confidentiality impact via blind SQLi without directly affecting integrity or availability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker browses any public page hosting a JetEngine Listing Grid, captures a legitimate Load More AJAX request to admin-ajax.php with action=listing_load_more, and appends a crafted meta_query row containing a time-based payload (e.g., a value that triggers SLEEP() via key manipulation) into filtered_query. The HMAC check passes because filtered_query is excluded from the signature, and the server executes the injected SQL fragment, allowing the attacker to enumerate wp_users credentials, secret_keys, or arbitrary table contents one bit at a time through response-timing or boolean inference. |
| Remediation | Upstream fix available (PR/commit); released patched version not independently confirmed from the provided data - administrators should consult the Crocoblock changelog at https://crocoblock.com/changelog/?plugin=jet-engine and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/fd839b20-69d1-4cad-80fc-3e7b9940fd30?source=cve to identify the exact fixed version above 3.8.10.1 and upgrade immediately. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Disable or uninstall JetEngine plugin versions ≤3.8.10.1 across all WordPress installations, or block external access to the listing_load_more AJAX handler via firewall/WAF. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
PHP Object Injection in the JetEngine WordPress plugin (versions through 3.8.9.1) allows authenticated users with the Co
Unauthenticated PHP Object Injection in Crocoblock JetEngine WordPress plugin versions 3.8.10 and earlier allows remote
Unauthenticated SQL injection in the JetEngine WordPress plugin (versions up to and including 3.8.9.1) allows remote att
Unauthenticated SQL injection in the JetEngine WordPress plugin versions prior to 3.8.9.1 allows remote attackers to inj
Unauthenticated SQL injection in the JetEngine WordPress plugin versions 3.8.10.1 and earlier allows remote attackers to
Share
External POC / Exploit Code
Leaving vuln.today