What is the CVSS score of CVE-2026-54187?

CVE-2026-54187 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of JetEngine are affected by CVE-2026-54187?

JetEngine WordPress plugin versions 3.8.10.1 and earlier contain a critical unauthenticated SQL injection vulnerability (CVSS 9.3) that allows remote attackers to extract sensitive database…

How to fix or mitigate CVE-2026-54187?

24 hours: Conduct inventory of all WordPress installations to identify JetEngine usage; immediately disable JetEngine plugin if version 3.8.10.1 or earlier is present. 7 days: Deploy Web Application Firewall (WAF) rules to block SQL injection payloads targeting the plugin if disabling is not operationally feasible; enable WordPress database query logging and alerts for anomalous activity. 30 days: Identify replacement plugin solutions for JetEngine functionality; establish vendor contact for patch release timeline and prepare staged rollout plan for patched versions when available.

JetEngine CVE-2026-54187

EUVD-2026-37632 CRITICAL

SQL Injection (CWE-89)

2026-06-17 Patchstack

SQLi Jetengine

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

9.3 CRITICAL

Unauthenticated network SQLi (AV:N/AC:L/PR:N/UI:N) reaching the WordPress DB beyond plugin scope (S:C) yields C:H; some write capability typical of SQLi gives I:L, A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 11:57 vuln.today

DescriptionCVE.org

Unauthenticated SQL Injection in JetEngine <= 3.8.10.1 versions.

AnalysisAI

Unauthenticated SQL injection in the JetEngine WordPress plugin versions 3.8.10.1 and earlier allows remote attackers to inject arbitrary SQL into backend database queries without credentials or user interaction. The CVSS 3.1 score of 9.3 (Critical) reflects a scope change with high confidentiality and low availability impact, indicating attacker-controlled queries can reach data beyond the plugin's own context. No public exploit identified at time of analysis, but the lack of authentication requirements makes this a high-priority patch target for any site running the affected versions.

Technical ContextAI

JetEngine (by Jetimpex / Crocoblock) is a widely deployed WordPress plugin that extends the platform with custom post types, meta fields, relations, dynamic listings, and query builders backed by direct SQL operations against the WordPress database. The flaw is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-supplied input is concatenated or otherwise embedded into a SQL statement without proper escaping or use of $wpdb->prepare(). The CPE cpe:2.3:a:jetimpex_inc.:jetengine:*:*:*:*:*:*:*:* combined with the disclosed ceiling of 3.8.10.1 indicates all currently released versions up to that point share the vulnerable code path until the vendor publishes a fixed build.

RemediationAI

Upgrade JetEngine to a version higher than 3.8.10.1 as soon as the vendor publishes a fixed build; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/jet-engine/vulnerability/wordpress-jetengine-plugin-3-8-10-1-sql-injection-vulnerability and the Crocoblock changelog for the exact patched version number. If a patched release is not yet available or cannot be applied immediately, deploy a WAF rule (Patchstack, Wordfence, or equivalent) that blocks SQL metacharacters and UNION/SELECT/SLEEP patterns on JetEngine REST and AJAX endpoints, restrict access to the plugin's listing/query endpoints via IP allowlisting at the web server, and consider temporarily deactivating JetEngine on internet-facing sites - noting that deactivation will break custom post types, listings, and dynamic content built with it. After patching, rotate WordPress secret keys, force password resets for administrators, and review database access logs for anomalous SELECTs against wp_users and wp_options.