What is the CVSS score of CVE-2026-12360?

CVE-2026-12360 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of JetEngine plugin are affected by CVE-2026-12360?

JetEngine WordPress plugin versions up to 3.8.10.1 contain an unauthenticated SQL injection vulnerability in the AJAX-based filter feature allowing unauthorized database extraction; no public exploit…

How to fix or mitigate CVE-2026-12360?

Within 24 hours: Disable or uninstall JetEngine plugin versions ≤3.8.10.1 across all WordPress installations, or block external access to the listing_load_more AJAX handler via firewall/WAF. Within 7 days: Review server logs and database access logs for evidence of exploitation attempts or suspicious queries from the vulnerable endpoint; assess scope of exposed data. Within 30 days: Monitor JetEngine releases for patch availability; evaluate alternative plugins or implement persistent WAF rules to sanitize meta_query parameters.

JetEngine plugin CVE-2026-12360

EUVD-2026-37552 HIGH

SQL Injection (CWE-89)

2026-06-17 Wordfence

WordPress SQLi Jetengine

7.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network-reachable AJAX endpoint with no user interaction; blind SQLi yields high confidentiality via data exfiltration but no inherent write or DoS impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 06:20 vuln.today

CVE Published

Jun 17, 2026 - 04:32 cve.org

HIGH 7.5

DescriptionCVE.org

The JetEngine plugin for WordPress is vulnerable to SQL injection in all versions up to and including 3.8.10.1. The listing_load_more AJAX handler accepts a filtered_query parameter that is intentionally excluded from the HMAC query signature check to support front-end filter integration. However, meta_query row values within filtered_query are not sanitized before being merged into SQL construction. This makes it possible for unauthenticated attackers to perform time-based or boolean blind SQL injection by appending a malicious meta_query value to a Load More AJAX request captured from any public Listing Grid page.

AnalysisAI

Unauthenticated SQL injection in the JetEngine WordPress plugin versions up to 3.8.10.1 allows remote attackers to extract database contents via the listing_load_more AJAX handler. The filtered_query parameter is deliberately excluded from the HMAC signature check to enable front-end filter integration, but meta_query row values are merged into SQL without sanitization, enabling time-based or boolean blind injection. No public exploit identified at time of analysis, though the bug was reported by Wordfence and source code locations are publicly referenced.

Technical ContextAI

JetEngine by Crocoblock is a widely deployed WordPress plugin for building dynamic listings, custom post types, and query-driven content (CPE cpe:2.3:a:crocoblock:jetengine:*). The vulnerability lives in includes/components/listings/ajax-handlers.php and the meta-query trait at includes/components/query-builder/queries/traits/meta-query.php, where filtered_query.meta_query rows feed into WP_Query/WP_Meta_Query SQL construction. The root cause is CWE-89 (Improper Neutralization of Special Elements in an SQL Command): an HMAC signature is normally used to bind AJAX query parameters, but filtered_query is whitelisted out of that signature to support legitimate front-end filter UIs, creating an asymmetric trust boundary where attacker-controlled meta_query values reach the SQL layer unsanitized.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed from the provided data - administrators should consult the Crocoblock changelog at https://crocoblock.com/changelog/?plugin=jet-engine and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/fd839b20-69d1-4cad-80fc-3e7b9940fd30?source=cve to identify the exact fixed version above 3.8.10.1 and upgrade immediately. Until upgraded, deploy a WAF rule (Wordfence, Cloudflare, or equivalent) that blocks listing_load_more AJAX requests containing meta_query keys with SQL meta-characters or UNION/SLEEP/BENCHMARK tokens in filtered_query, accepting the trade-off that legitimate complex filter queries may be impacted. As a stronger compensating control, restrict access to /wp-admin/admin-ajax.php?action=listing_load_more from untrusted networks or disable Listing Grids until patched; this will break public listing-filter functionality on the front end.