CVE-2026-4662

The JetEngine plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 3.8.6.1. The flaw resides in the listing_load_more AJAX action, where the filtered_query parameter is excluded from HMAC signature validation, allowing attacker-controlled input to bypass security checks. Additionally, the prepare_where_clause() method in the SQL Query Builder fails to sanitize the compare operator before concatenating it into SQL statements [1].

Exploitation requires the site to have a JetEngine Listing Grid with Load More enabled that uses a SQL Query Builder query. An unauthenticated attacker can send a crafted AJAX request to the listing_load_more action, injecting arbitrary SQL via the compare operator. No authentication is needed, and the attack can be performed remotely over HTTP [1].

Successful exploitation allows an unauthenticated attacker to append additional SQL queries to existing ones, potentially extracting sensitive information from the WordPress database, such as user credentials or other confidential data. The CVSS v3 base score is 7.5 (High), reflecting the ease of exploitation and potential impact [1].

Crocoblock has addressed this vulnerability in JetEngine version 3.8.6.2, as noted in their changelog. Users are strongly advised to update to the latest version immediately. No workarounds have been published, and the vulnerability is not known to be listed in CISA's Known Exploited Vulnerabilities catalog at the time of publication [1].