What is the CVSS score of CVE-2026-4352?

CVE-2026-4352 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2026-4352?

CVE-2026-4352 is a critical SQL injection vulnerability in JetEngine WordPress plugin versions 3.8.6.1 and earlier that allows unauthenticated attackers to directly access sensitive database…

How to fix or mitigate CVE-2026-4352?

Within 24 hours: Disable or restrict REST API access to JetEngine Custom Content Type endpoints via firewall rules or WordPress security plugins (e.g., Wordfence, Sucuri) until patching is available. Within 7 days: Contact JetEngine vendor for patch availability; if unavailable, implement Web Application Firewall (WAF) rules to block malicious SQL patterns in REST queries and conduct database audit for unauthorized access logs. Within 30 days: Upgrade to patched JetEngine version immediately upon release; perform full database integrity assessment and credential rotation for exposed accounts.

WordPress CVE-2026-4352

EUVD-2026-22195 HIGH

SQL Injection (CWE-89)

2026-04-14 Wordfence

WordPress SQLi

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 20:37 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 02:08 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 02:00 euvd

EUVD-2026-22195

Analysis Generated

Apr 14, 2026 - 02:00 vuln.today

CVE Published

Apr 14, 2026 - 01:25 nvd

HIGH 7.5

DescriptionCVE.org

The JetEngine plugin for WordPress is vulnerable to SQL Injection via the Custom Content Type (CCT) REST API search endpoint in all versions up to, and including, 3.8.6.1. This is due to the _cct_search parameter being interpolated directly into a SQL query string via sprintf() without sanitization or use of $wpdb->prepare(). WordPress REST API's wp_unslash() call on $_GET strips the wp_magic_quotes() protection, allowing single-quote-based injection. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The Custom Content Types module must be enabled with at least one CCT configured with a public REST GET endpoint for exploitation.

AnalysisAI

SQL injection in JetEngine WordPress plugin (≤3.8.6.1) via Custom Content Type REST API allows unauthenticated remote attackers to extract sensitive database information. The vulnerability stems from unsanitized search parameters in REST endpoints, bypassing WordPress's built-in SQL protections. Attack complexity is low (CVSS AC:L) with no user interaction required. EPSS and KEV data not provided; exploitation requires Custom Content Types module enabled with public REST endpoints configured.

Technical ContextAI

JetEngine is a WordPress plugin by Crocoblock that extends content management capabilities through Custom Content Types (CCT). The vulnerability exists in the CCT REST API search implementation where the '_cct_search' parameter is passed directly into SQL query construction using sprintf() without parameterization or sanitization. WordPress core's wp_magic_quotes() normally adds protective escaping to user input, but the REST API architecture calls wp_unslash() on $_GET parameters before routing, stripping this protection. Without compensating sanitization via $wpdb->prepare() - WordPress's recommended SQL preparation method - single-quote characters remain unescaped, enabling classic SQL injection attacks. This is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), the foundational weakness underlying SQL injection vulnerabilities. The affected component is identified as cpe:2.3:a:crocoblock:jetengine, affecting all versions through 3.8.6.1.

RemediationAI

Upgrade JetEngine to version 3.8.6.2 or later, which should address this SQL injection vulnerability through proper input sanitization using WordPress's $wpdb->prepare() method. Consult the official Crocoblock plugin page at https://crocoblock.com/plugins/jetengine/ and monitor vendor security advisories for patch release confirmation. As an immediate mitigation measure if patching is delayed, administrators can disable the Custom Content Types module or restrict REST API access using WordPress security plugins or web application firewall rules to block unauthenticated access to endpoints matching the pattern /wp-json/jet-cct/. Conduct database audits to identify potential unauthorized data access if vulnerable configurations were previously exposed. Detailed vulnerability analysis is available from Wordfence Threat Intelligence at https://www.wordfence.com/threat-intel/vulnerabilities/id/29a5701f-92f7-4a02-a990-b189a381cff5?source=cve.