What is the CVSS score of CVE-2026-49084?

CVE-2026-49084 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of JetEngine are affected by CVE-2026-49084?

A critical unauthenticated SQL injection in the widely-deployed JetEngine WordPress plugin enables remote attackers to directly access and exfiltrate sensitive database content without credentials.. A patch is available.

How to fix or mitigate CVE-2026-49084?

WITHIN 24 HOURS: Inventory all WordPress installations using JetEngine; identify affected versions (prior to 3.8.9.1); document data sensitivity and exposure scope. WITHIN 7 DAYS: Deploy WAF rules to block SQL injection patterns targeting JetEngine; implement IP-based access restrictions or temporary plugin disable if operationally feasible; establish database query logging and alerting for exploitation indicators. WITHIN 30 DAYS: Monitor Crocoblock advisories for release of JetEngine 3.8.9.1 or later; test patch in staging; deploy to production once vendor patch is confirmed available.

JetEngine CVE-2026-49084

EUVD-2026-37621 CRITICAL

SQL Injection (CWE-89)

2026-06-17 Patchstack

SQLi Jetengine

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

9.3 CRITICAL

Unauthenticated network-reachable SQLi in a WordPress plugin endpoint; read-only injection path per reporter justifies I:N while cross-boundary DB access supports S:C and C:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Patch available

Jun 17, 2026 - 13:01 EUVD

Analysis Generated

Jun 17, 2026 - 12:03 vuln.today

DescriptionCVE.org

Unauthenticated SQL Injection in JetEngine < 3.8.9.1 versions.

AnalysisAI

Unauthenticated SQL injection in the JetEngine WordPress plugin versions prior to 3.8.9.1 allows remote attackers to inject malicious SQL into backend database queries without any authentication or user interaction. The flaw carries a CVSS 3.1 score of 9.3 with a changed scope, enabling data disclosure across the WordPress installation and partial impact on availability. No public exploit identified at time of analysis, but the unauthenticated network-reachable nature combined with JetEngine's wide deployment across Crocoblock-powered WordPress sites makes this a high-priority issue.

Technical ContextAI

JetEngine is a popular commercial WordPress plugin by Jetimpex/Crocoblock used to build dynamic content, custom post types, taxonomies, and listings - it is one of the most widely deployed page-builder add-ons in the WordPress ecosystem. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-controlled input reaches a database query without proper parameterization or sanitization, allowing attacker-supplied SQL fragments to alter query semantics. The affected CPE cpe:2.3:a:jetimpex_inc.:jetengine covers all JetEngine releases up to but not including 3.8.9.1, and the changed CVSS scope (S:C) indicates the injection can affect resources beyond the vulnerable component - typically the entire WordPress database including wp_users and wp_options tables holding credentials and secret keys.

RemediationAI

Vendor-released patch: upgrade JetEngine to version 3.8.9.1 or later immediately via the WordPress plugin administration screen or by downloading the fixed release from Crocoblock; the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/jet-engine/vulnerability/wordpress-jetengine-plugin-3-8-9-1-sql-injection-vulnerability is the authoritative reference. Until patching is complete, deploy a WordPress WAF (Patchstack, Wordfence, or equivalent) with virtual patching rules for this CVE, which blocks the malicious request signatures with minimal functional side effects beyond occasional false positives on legitimate dynamic-listing queries. As a stronger but more disruptive interim control, deactivate the JetEngine plugin - this will break any front-end listings, custom post types, and dynamic widgets it powers, so coordinate with site owners before doing so. After patching, rotate WordPress secret keys in wp-config.php and audit wp_users for any unauthorized changes, since unauthenticated read-level SQLi can expose password hashes suitable for offline cracking.