EUVD-2026-37619Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running JetSearch ≤ 3.5.17
-
DeliveryCraft SQL injection payload for search endpoint
-
ExploitSend unauthenticated HTTP request to vulnerable parameter
-
ExecutionDatabase executes injected query
-
ImpactExfiltrate user hashes and site secrets
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of any WordPress site with the JetSearch plugin (version 3.5.17 or earlier) installed and active. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms network-reachable, low-complexity, no-privileges, no-user-interaction exploitation. Limiting factors are narrow: the plugin must be installed and activated, and the vulnerable search endpoint must be reachable (i.e., not blocked by a WAF, IP allowlist, or maintenance mode). No specific WordPress version, PHP version, or non-default plugin configuration is implied by the available data. |
| Impact | All available signals point to elevated real-world risk: CVSS 9.3 with AV:N/AC:L/PR:N/UI:N means trivially exploitable over the network with no prerequisites, and the scope change (S:C) plus high confidentiality impact (C:H) reflect database-wide data exposure. The Patchstack tagging and the SQLi/Jetsearch labels indicate a verified plugin-marketplace finding rather than a speculative report. EPSS score was not provided in the input, and the CVE is not on CISA KEV, so widespread automated exploitation is not yet confirmed - however, SQLi in WordPress plugins is historically a favored target for opportunistic mass-scanning campaigns, so absence of KEV listing should not be read as low priority. The I:N (no integrity impact) rating is unusual for SQLi and suggests Patchstack assessed this as a read-only injection (e.g., UNION-based extraction) rather than one allowing INSERT/UPDATE/DELETE - defenders should verify this assumption with the vendor advisory. |
| Exploit ScenarioDerived | An unauthenticated remote attacker sends a crafted HTTP request to the JetSearch AJAX or REST endpoint on a vulnerable WordPress site, embedding a UNION-based or boolean-blind SQL injection payload in a search parameter. The injected query executes against the WordPress database, allowing the attacker to extract sensitive data such as user password hashes from wp_users, secret keys from wp_options, or any custom table data - all without authentication, user interaction, or social engineering. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 17, 2026
Unauthenticated SQL injection in the JetSearch WordPress plugin (versions <= 3.5.17) allows remote attackers to inject arbitrary SQL into backend database queries without any authentication or user interaction. The flaw carries a CVSS 9.3 (Critical) score with a scope change, meaning impact extends beyond the plugin to the underlying WordPress database. No public exploit identified at time of analysis, but the trivial attack complexity and lack of authentication requirement make this a high-priority patching target for any WordPress site running the plugin.
RemediationAI
Upstream fix available per Patchstack advisory; released patched version not independently confirmed from the supplied data - administrators should upgrade JetSearch to the latest available version greater than 3.5.17 as published by Jetimpex/Crocoblock and verify via the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/jet-search/vulnerability/wordpress-jetsearch-plugin-3-5-17-sql-injection-vulnerability. If immediate patching is not possible, compensating controls include deactivating the JetSearch plugin entirely (which will break AJAX search functionality on the site), placing the WordPress admin-ajax.php and REST API search endpoints behind a WAF with SQLi signatures tuned for UNION/boolean-based payloads (may produce false positives on legitimate search queries containing quotes or SQL keywords), and restricting the database user's privileges to the minimum required (will not prevent data extraction from accessible tables but limits write-based escalation if the I:N rating proves incorrect).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JetSearch (cpe:2.3:a:jetimpex_inc.:jetsearch) is an AJAX-driven search plugin for WordPress developed by Jetimpex (Crocoblock), commonly bundled with Elementor and JetEngine deployments. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), indicating user-supplied input is concatenated into SQL queries - likely via an AJAX search endpoint or REST handler - without proper parameterization through WordPress's $wpdb->prepare() API. Because WordPress plugins share the global database connection, injection here can read or modify any table the WordPress DB user can access (wp_users, wp_options, custom tables).
Know when Jetsearch gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Unauthenticated network-reachable SQLi (AV:N/AC:L/PR:N/UI:N); scope changes to DB (S:C); high data disclosure (C:H), low integrity from possible query manipulation, no availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated SQL Injection in JetSearch <= 3.5.17 versions.
Executive ViewAI
JetSearch WordPress plugin (versions ≤3.5.17) contains an unauthenticated SQL injection vulnerability (CVSS 9.3) that permits remote database access without credentials or user interaction, exposing the complete WordPress database to unauthorized modification and exfiltration. Any organization running this plugin faces immediate data breach risk. The absence of a vendor patch makes emergency remediation-immediate plugin deactivation-a critical business priority to protect customer data, operational continuity, and regulatory compliance.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Immediately deactivate the plugin; (2) Deploy WAF rules blocking SQL injection signatures; (3) Restrict database access at network level to trusted application servers only; (4) Enable database activity monitoring (DAM) with real-time alerting for unauthorized queries; (5) Maintain current automated backups and test recovery procedures weekly; (6) Monitor vendor advisory channels for patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Stored cross-site scripting in the JetSearch WordPress plugin (versions 3.6.3 and earlier, published by Crocoblock / Jet
Unauthenticated sensitive data exposure in Crocoblock JetSearch WordPress plugin (all versions through 3.6.1.2) permits
GitHub PoC
Exploit-DB