What is the CVSS score of CVE-2026-49079?

CVE-2026-49079 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of JetSearch are affected by CVE-2026-49079?

JetSearch WordPress plugin (versions ≤3.5.17) contains an unauthenticated SQL injection vulnerability (CVSS 9.3) that permits remote database access without credentials or user interaction, exposing…

How to fix or mitigate CVE-2026-49079?

Within 24 hours: Disable and deactivate the JetSearch plugin on all WordPress instances running version 3.5.17 or earlier; document current deployed versions. Within 7 days: Evaluate and migrate to a hardened alternative search plugin; if JetSearch functionality is operationally critical, deploy Web Application Firewall (WAF) rules to detect SQL injection patterns and restrict database queries to known-legitimate schemas. Within 30 days: Monitor vendor advisory channels for patch release (target version 3.5.18 or later); upon availability, test in staging and apply enterprise-wide, then re-enable plugin.

JetSearch CVE-2026-49079

EUVD-2026-37619 CRITICAL

SQL Injection (CWE-89)

2026-06-17 Patchstack

WordPress SQLi Wordpress Plugin Jetsearch Jetimpex Inc

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

9.3 CRITICAL

Unauthenticated network-reachable SQLi (AV:N/AC:L/PR:N/UI:N); scope changes to DB (S:C); high data disclosure (C:H), low integrity from possible query manipulation, no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:05 vuln.today

DescriptionCVE.org

Unauthenticated SQL Injection in JetSearch <= 3.5.17 versions.

AnalysisAI

Unauthenticated SQL injection in the JetSearch WordPress plugin (versions <= 3.5.17) allows remote attackers to inject arbitrary SQL into backend database queries without any authentication or user interaction. The flaw carries a CVSS 9.3 (Critical) score with a scope change, meaning impact extends beyond the plugin to the underlying WordPress database. No public exploit identified at time of analysis, but the trivial attack complexity and lack of authentication requirement make this a high-priority patching target for any WordPress site running the plugin.

Technical ContextAI

JetSearch (cpe:2.3:a:jetimpex_inc.:jetsearch) is an AJAX-driven search plugin for WordPress developed by Jetimpex (Crocoblock), commonly bundled with Elementor and JetEngine deployments. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), indicating user-supplied input is concatenated into SQL queries - likely via an AJAX search endpoint or REST handler - without proper parameterization through WordPress's $wpdb->prepare() API. Because WordPress plugins share the global database connection, injection here can read or modify any table the WordPress DB user can access (wp_users, wp_options, custom tables).

RemediationAI

Upstream fix available per Patchstack advisory; released patched version not independently confirmed from the supplied data - administrators should upgrade JetSearch to the latest available version greater than 3.5.17 as published by Jetimpex/Crocoblock and verify via the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/jet-search/vulnerability/wordpress-jetsearch-plugin-3-5-17-sql-injection-vulnerability. If immediate patching is not possible, compensating controls include deactivating the JetSearch plugin entirely (which will break AJAX search functionality on the site), placing the WordPress admin-ajax.php and REST API search endpoints behind a WAF with SQLi signatures tuned for UNION/boolean-based payloads (may produce false positives on legitimate search queries containing quotes or SQL keywords), and restricting the database user's privileges to the minimum required (will not prevent data extraction from accessible tables but limits write-based escalation if the I:N rating proves incorrect).