EUVD-2026-14743
GHSA-g8j8-q3w7-359j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted AJAX request to listing_load_more
-
ExploitBypass HMAC validation via filtered_query parameter
-
ExecutionInject SQL into compare operator
-
ImpactExtract sensitive database information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires WordPress with JetEngine plugin versions up to 3.8.6.1 installed and active. No authentication needed. Attacker sends crafted AJAX request to |
| Impact | The CVSS 3.1 score of 7.5 with vector AV:N/AC:L/PR:N/UI:N indicates this is a network-accessible vulnerability with low attack complexity requiring no privileges or user interaction, presenting significant real-world risk. The vulnerability is exploitable by unauthenticated attackers, making it highly automatable and increasing the attack surface dramatically. However, exploitation requires specific preconditions: the target site must have a JetEngine Listing Grid with Load More enabled using SQL Query Builder queries, which somewhat limits the scope. The impact is limited to confidentiality (C:H) with no integrity or availability impact, meaning attackers can exfiltrate database contents but not modify or destroy data. Without EPSS data or KEV listing status provided, and given the specificity of exploitation requirements, this represents a moderate-to-high priority for organizations using JetEngine with the affected configuration, but may not warrant emergency response for sites not meeting the preconditions. |
| Exploit ScenarioDerived | An unauthenticated attacker identifies a WordPress site running JetEngine with a Listing Grid featuring Load More functionality backed by SQL Query Builder. The attacker crafts a malicious AJAX request to the listing_load_more endpoint, manipulating the filtered_query parameter (which bypasses HMAC validation) to inject SQL commands through the unsanitized compare operator. The attacker executes a UNION-based SQL injection to extract sensitive data such as user credentials, personal information, or proprietary business data from the WordPress database, requiring only basic SQL injection knowledge and no authentication. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 24, 2026
The JetEngine plugin for WordPress contains a SQL injection vulnerability in the listing_load_more AJAX action that allows unauthenticated attackers to extract sensitive database information. All versions up to and including 3.8.6.1 are affected. The vulnerability exists on sites using JetEngine Listing Grid with Load More functionality enabled and SQL Query Builder queries, with a CVSS score of 7.5 indicating high severity for confidentiality impact.
RemediationAI
Upgrade the JetEngine plugin to a version newer than 3.8.6.1 that addresses this vulnerability. Check the Crocoblock changelog at https://crocoblock.com/changelog/?plugin=jet-engine for the patched release version and apply the update immediately. As an interim mitigation while awaiting patching, consider temporarily disabling the Load More functionality on JetEngine Listing Grids that use SQL Query Builder queries, or implement Web Application Firewall (WAF) rules to filter requests to the listing_load_more AJAX action. Network-level access controls limiting WordPress admin access to trusted IP ranges can reduce exposure but will not prevent exploitation since the vulnerability is exploitable by unauthenticated users through public-facing AJAX endpoints. Detailed technical analysis is available in the Wordfence threat intelligence report at https://www.wordfence.com/threat-intel/vulnerabilities/id/f10cf49b-1b78-43c1-b0d1-c1dbb74d5696?source=cve.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability affects the JetEngine plugin (cpe:2.3:a:crocoblock:jetengine) developed by Crocoblock for WordPress. The root cause is a classic SQL Injection (CWE-89) stemming from two combined weaknesses: first, the filtered_query parameter is excluded from HMAC signature validation in the ajax-handlers.php file, allowing attackers to bypass authentication controls; second, the prepare_where_clause() method in the SQL Query Builder (sql.php) fails to sanitize the compare operator before concatenating it into SQL statements. This creates a scenario where untrusted input flows directly into database queries without proper parameterization or escaping, enabling SQL injection attacks through the listing_load_more AJAX endpoint.
Know when Jetengine gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
The JetEngine plugin for WordPress is vulnerable to SQL Injection via the listing_load_more AJAX action in all versions up to, and including, 3.8.6.1. This is due to the filtered_query parameter being excluded from the HMAC signature validation (allowing attacker-controlled input to bypass security checks) combined with the prepare_where_clause() method in the SQL Query Builder not sanitizing the compare operator before concatenating it into SQL statements. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database, provided the site has a JetEngine Listing Grid with Load More enabled that uses a SQL Query Builder query.
Executive ViewAI
A critical SQL injection vulnerability in the JetEngine WordPress plugin (versions up to 3.8.6.1) allows attackers to access sensitive database information without authentication. Organizations using this plugin with Load More functionality enabled face immediate risk of data breach and require urgent mitigation until a patch is available.
Disable JetEngine Listing Grid Load More feature immediately; implement Web Application Firewall (WAF) rules to block requests to listing_load_more AJAX action; restrict database user permissions to least-privilege access; enable query logging and monitoring for suspicious SQL patterns; consider network segmentation to limit database accessibility; monitor vendor for patch release and prepare rapid deployment plan.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Unauthenticated SQL injection in the JetEngine WordPress plugin (versions up to and including 3.8.9.1) allows remote att
Stored Cross-Site Scripting in the JetEngine WordPress plugin (all versions before 3.8.13.1) allows unauthenticated remo
Remote code execution in Crocoblock JetEngine (WordPress plugin) versions 3.8.14 and earlier allows unauthenticated atta
Unauthenticated PHP Object Injection in Crocoblock JetEngine WordPress plugin versions 3.8.10 and earlier allows remote
PHP Object Injection in the JetEngine WordPress plugin (versions through 3.8.9.1) allows authenticated users with the Co
Crocoblock JetEngine before 2.9.1 does not properly validate and sanitize form data. Rated critical severity (CVSS 9.8),
Stored Cross-Site Scripting in JetEngine WordPress plugin before 3.8.12 allows users holding the Contributor role or hig
Unauthenticated SQL injection in the JetEngine WordPress plugin versions 3.8.10.1 and earlier allows remote attackers to
Unauthenticated SQL injection in the JetEngine WordPress plugin versions prior to 3.8.9.1 allows remote attackers to inj
SQL injection in Crocoblock JetEngine (a WordPress plugin) through version 3.8.8.1 allows remote unauthenticated attacke
Crocoblock JetEngine versions below 3.8.4.1 are vulnerable to unsafe deserialization of untrusted data, enabling authent
SQL injection in Crocoblock JetEngine through version 3.9.0 allows an authenticated low-privilege user on a WordPress si
Exploit-DB