Jetengine CVE-2026-4352

JetEngine plugin for WordPress versions up to 3.8.6.1 with the Custom Content Type (CCT) REST API endpoint enabled. Unauthenticated remote attacker sends crafted SQL injection payload via the _cct_search parameter to the REST API search endpoint. No user interaction required.

Real-world risk is HIGH for WordPress sites running JetEngine with exposed Custom Content Types. The CVSS 3.1 score of 7.5 reflects critical risk factors: network-based attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and high confidentiality impact (C:H). The unauthenticated attack surface significantly amplifies risk since REST API endpoints are publicly accessible by default in WordPress. However, exploitation requires specific configuration prerequisites: the Custom Content Types module must be actively enabled with at least one CCT configured to expose a public REST GET endpoint. This configuration-dependent attack surface may limit the number of vulnerable instances compared to the total JetEngine install base. Without EPSS probability data, KEV status, or confirmed public exploits in the provided intelligence, we cannot assess active exploitation likelihood. The CVSS vector indicates this is primarily an information disclosure threat (I:N, A:N) rather than a code execution or site takeover scenario, though extracted database credentials could enable secondary attacks. Organizations should prioritize remediation based on whether they use CCT functionality and expose REST endpoints publicly.

An unauthenticated attacker identifies a WordPress site running JetEngine with Custom Content Types enabled and public REST endpoints exposed. The attacker crafts an HTTP GET request to the CCT search endpoint with a malicious '_cct_search' parameter containing SQL injection payload: single-quote characters to break out of the original query context followed by UNION SELECT statements to extract sensitive data from wp_users, wp_options, or custom tables. The unsanitized parameter executes arbitrary SQL commands, allowing the attacker to enumerate usernames, password hashes, email addresses, API keys stored in options, or proprietary content from custom database tables. Since the attack vector is network-based with low complexity and no authentication required, automated scanning tools can identify and exploit vulnerable instances at scale.