PT-2026-27331 · WordPress · Jetengine

Published 2026-03-24 · Updated 2026-03-24 · CVE-2026-4662

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions JetEngine versions prior to 3.8.6.1

Description The JetEngine plugin for WordPress is susceptible to SQL Injection through the listing load more AJAX action. This is because the filtered query parameter lacks HMAC signature validation, allowing attackers to bypass security measures. Additionally, the prepare where clause() method within the SQL Query Builder does not sanitize the compare operator before incorporating it into SQL statements. This allows unauthenticated attackers to inject additional SQL queries into existing queries, potentially extracting sensitive database information. This is possible when a JetEngine Listing Grid with Load More enabled utilizes a SQL Query Builder query.

Recommendations Update JetEngine to version 3.8.6.1 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-4662

Affected Products

Jetengine

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-4662 · Security Note
• https://crocoblock.com/changelog/?plugin=jet-engine · Note
• https://plugins.trac.wordpress.org/browser/jet-engine/tags/3.8.6.1/includes/components/query-builder/listings/query.php#L125 · Note
• https://plugins.trac.wordpress.org/browser/jet-engine/tags/3.8.6.1/includes/components/listings/ajax-handlers.php#L251 · Note
• https://plugins.trac.wordpress.org/browser/jet-engine/tags/3.8.6.1/includes/components/query-builder/queries/sql.php#L962 · Note
• https://plugins.trac.wordpress.org/browser/jet-engine/tags/3.8.6.1/includes/components/query-builder/queries/sql.php#L1038 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/f10cf49b-1b78-43c1-b0d1-c1dbb74d5696?source=cve · Note