What is the CVSS score of EUVD-2026-39720?

EUVD-2026-39720 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.2%.

Which versions of JetSmartFilters are affected by EUVD-2026-39720?

JetSmartFilters, a widely-used WordPress plugin by Crocoblock, contains a critical unauthenticated SQL injection vulnerability affecting all versions through 3.8.3 that allows attackers to directly…

How to fix or mitigate EUVD-2026-39720?

24 hours: Inventory all WordPress installations for JetSmartFilters plugin versions up to 3.8.3; deactivate and disable the plugin immediately on all affected sites. 7 days: Completely remove the plugin from all environments; deploy Web Application Firewall rules blocking SQL injection patterns in plugin filter parameters; audit and restrict database user privileges to least-privilege access model. 30 days: No vendor-released patch identified at time of analysis-monitor Crocoblock security advisories continuously; upon patch release, test in non-production environment and apply within 48 hours; audit database logs for exploitation attempts during exposure window.

JetSmartFilters EUVD-2026-39720

| CVE-2026-56067 CRITICAL

SQL Injection (CWE-89)

2026-06-26 audit@patchstack.com

GHSA-c2rx-68rq-4pfx

WordPress SQLi Wordpress Plugin

9.3

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

7.5 HIGH

Unauthenticated network SQLi with low complexity (AV:N/AC:L/PR:N), primarily data disclosure so C:H; no clear write/integrity or availability impact and no cross-system scope change, so I:N/A:N/S:U.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 15:57 vuln.today

DescriptionCVE.org

Unauthenticated SQL Injection in JetSmartFilters <= 3.8.3 versions.

AnalysisAI

Unauthenticated SQL injection in the JetSmartFilters WordPress plugin (Crocoblock) affects all versions up to and including 3.8.3, letting remote attackers with no authentication inject crafted SQL through plugin filter parameters and read sensitive database contents. The CVSS 9.3 rating reflects network reachability with no privileges or user interaction required; the issue was reported by Patchstack. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

JetSmartFilters is a commercial Crocoblock plugin that adds AJAX-driven filtering widgets (checkboxes, ranges, search) for Elementor/WordPress listings, building dynamic WordPress database (WPDB/MySQL) queries from user-supplied filter parameters. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): one or more filter request parameters are concatenated into a SQL statement without proper parameterization or use of $wpdb->prepare(), so attacker-controlled input alters the query structure. Because the vulnerable endpoint is reachable by unauthenticated requests (front-end AJAX filtering), no valid WordPress account is needed to reach the injectable code path.

RemediationAI

Upgrade JetSmartFilters to a version newer than 3.8.3 once Crocoblock publishes a fixed release; the input does not specify an exact patched version, so no vendor-released fix version is independently confirmed at time of analysis - verify the current fixed version against the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/jet-smart-filters/vulnerability/wordpress-jetsmartfilters-plugin-3-8-3-sql-injection-vulnerability?_s_id=cve) and the Crocoblock changelog before relying on it. Until a confirmed patched build is installed, deploy a WAF or virtual patch (Patchstack offers one) with SQL-injection rules targeting the plugin's AJAX filter endpoints, accepting added latency and possible false positives on legitimate filter queries; restrict or rate-limit access to the JetSmartFilters AJAX action and front-end filtering endpoints, with the trade-off that this can break site filtering functionality; and ensure the WordPress database account runs with least privilege to limit what a successful injection can read. If filtering is not business-critical, fully deactivating JetSmartFilters removes the exposure entirely.