What is the CVSS score of CVE-2026-4662?

CVE-2026-4662 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2026-4662?

A critical SQL injection vulnerability in the JetEngine WordPress plugin (versions up to 3.8.6.1) allows attackers to access sensitive database information without authentication.

How to fix or mitigate CVE-2026-4662?

Within 24 hours: Audit WordPress installations for JetEngine plugin presence and version; disable Listing Grid Load More functionality if the plugin is deployed. Within 7 days: Implement WAF rules blocking suspicious AJAX requests to listing_load_more; apply network segmentation to restrict database access. Within 30 days: Monitor vendor communications for patch availability; prepare deployment procedures and test in non-production environments before production rollout.

WordPress CVE-2026-4662

EUVD-2026-14743 HIGH

SQL Injection (CWE-89)

2026-03-24 Wordfence

GHSA-g8j8-q3w7-359j

WordPress SQLi

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 24, 2026 - 05:15 euvd

EUVD-2026-14743

Analysis Generated

Mar 24, 2026 - 05:15 vuln.today

CVE Published

Mar 24, 2026 - 04:27 nvd

HIGH 7.5

DescriptionCVE.org

The JetEngine plugin for WordPress is vulnerable to SQL Injection via the listing_load_more AJAX action in all versions up to, and including, 3.8.6.1. This is due to the filtered_query parameter being excluded from the HMAC signature validation (allowing attacker-controlled input to bypass security checks) combined with the prepare_where_clause() method in the SQL Query Builder not sanitizing the compare operator before concatenating it into SQL statements. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database, provided the site has a JetEngine Listing Grid with Load More enabled that uses a SQL Query Builder query.

AnalysisAI

The JetEngine plugin for WordPress contains a SQL injection vulnerability in the listing_load_more AJAX action that allows unauthenticated attackers to extract sensitive database information. All versions up to and including 3.8.6.1 are affected. The vulnerability exists on sites using JetEngine Listing Grid with Load More functionality enabled and SQL Query Builder queries, with a CVSS score of 7.5 indicating high severity for confidentiality impact.

Technical ContextAI

This vulnerability affects the JetEngine plugin (cpe:2.3:a:crocoblock:jetengine) developed by Crocoblock for WordPress. The root cause is a classic SQL Injection (CWE-89) stemming from two combined weaknesses: first, the filtered_query parameter is excluded from HMAC signature validation in the ajax-handlers.php file, allowing attackers to bypass authentication controls; second, the prepare_where_clause() method in the SQL Query Builder (sql.php) fails to sanitize the compare operator before concatenating it into SQL statements. This creates a scenario where untrusted input flows directly into database queries without proper parameterization or escaping, enabling SQL injection attacks through the listing_load_more AJAX endpoint.

RemediationAI

Upgrade the JetEngine plugin to a version newer than 3.8.6.1 that addresses this vulnerability. Check the Crocoblock changelog at https://crocoblock.com/changelog/?plugin=jet-engine for the patched release version and apply the update immediately. As an interim mitigation while awaiting patching, consider temporarily disabling the Load More functionality on JetEngine Listing Grids that use SQL Query Builder queries, or implement Web Application Firewall (WAF) rules to filter requests to the listing_load_more AJAX action. Network-level access controls limiting WordPress admin access to trusted IP ranges can reduce exposure but will not prevent exploitation since the vulnerability is exploitable by unauthenticated users through public-facing AJAX endpoints. Detailed technical analysis is available in the Wordfence threat intelligence report at https://www.wordfence.com/threat-intel/vulnerabilities/id/f10cf49b-1b78-43c1-b0d1-c1dbb74d5696?source=cve.