What is the CVSS score of CVE-2026-49076?

CVE-2026-49076 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.4%.

Which versions of JetEngine are affected by CVE-2026-49076?

JetEngine WordPress plugin (versions ≤3.8.9.1) contains a critical unauthenticated SQL injection vulnerability allowing remote attackers to read, modify, or delete sensitive database records without…

How to fix or mitigate CVE-2026-49076?

24 hours: Inventory all WordPress instances running JetEngine ≤3.8.9.1; disable the plugin immediately on all affected sites. No public exploit identified at time of analysis, but proactive remediation is critical given CVSS 9.3 severity and unauthenticated attack vector. 7 days: Deploy Web Application Firewall (WAF) rules to filter SQL injection patterns in plugin parameters; implement alternative solutions (Elementor or native WordPress blocks) to replace JetEngine functionality. 30 days: Monitor Crocoblock.com and patchstack.com for patch availability; prepare immediate upgrade path once vendor releases version >3.8.9.1.

JetEngine CVE-2026-49076

EUVD-2026-37618 CRITICAL

SQL Injection (CWE-89)

2026-06-17 Patchstack

SQLi Jetengine

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

9.3 CRITICAL

Unauthenticated network SQLi against a WordPress plugin justifies AV:N/AC:L/PR:N/UI:N and S:C (DB beyond plugin scope); C:H for full DB read, I:L because hash exfiltration plausibly enables limited integrity impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:05 vuln.today

DescriptionCVE.org

Unauthenticated SQL Injection in JetEngine <= 3.8.9.1 versions.

AnalysisAI

Unauthenticated SQL injection in the JetEngine WordPress plugin (versions up to and including 3.8.9.1) allows remote attackers without credentials to inject arbitrary SQL through plugin-handled inputs. With a CVSS 3.1 score of 9.3 (scope-changed) and no authentication or user interaction required, the flaw is well-suited for opportunistic, mass exploitation of WordPress sites that use this popular Crocoblock plugin. No public exploit identified at time of analysis, but Patchstack has catalogued the issue, indicating vendor-side confirmation.

Technical ContextAI

JetEngine by Crocoblock (Jetimpex Inc., CPE cpe:2.3:a:jetimpex_inc.:jetengine) is a widely deployed WordPress plugin that extends Elementor with dynamic content, custom post types, listings, and query-driven UI components - features that inherently build SQL queries from user-influenced parameters. The root cause class is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning untrusted input reaches a SQL statement without proper parameterization or escaping. In WordPress, this typically means improper use of $wpdb->query/get_results without prepare(), allowing injected fragments to alter query logic against the shared site database, which can expose wp_users password hashes, secrets in wp_options, and other tenants' data.

RemediationAI

Upstream fix available per Patchstack advisory; released patched version not independently confirmed in the provided data - administrators should consult https://patchstack.com/database/wordpress/plugin/jet-engine/vulnerability/wordpress-jetengine-plugin-3-8-9-1-sql-injection-vulnerability-2 and the Crocoblock changelog to identify the exact fixed JetEngine release (any version > 3.8.9.1) and upgrade via the WordPress plugins screen or WP-CLI. Until upgrade is complete, deploy a WAF or virtual-patching layer (Patchstack, Wordfence, Cloudflare managed ruleset) to block SQLi payloads targeting JetEngine REST/AJAX endpoints; the side effect is potential false positives on legitimate listing queries with complex filter strings. If a WAF is unavailable, temporarily deactivate JetEngine - this will break Elementor pages, dynamic listings, and custom post type front-end rendering that depend on it, so schedule a maintenance window. As a hardening measure, rotate WordPress salts/keys, force password resets for all administrators, and audit wp_options for unexpected entries (e.g., backdoor admin accounts, malicious siteurl values) since unauthenticated read access to the DB plausibly leaked credentials.