CVE-2026-115608: WordPress JetEngine plugin <= 3.9.0 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows SQL Injection.This issue affects JetEngine: from n/a through 3.9.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress JetEngine pluginto a version that resolves this vulnerability.Fixed in 3.9.0.1
Event History
Frequently Asked Questions
Who can exploit this issue?
The CVSS vector indicates that exploitation is network-accessible, requires low privileges, and does not require user interaction. An attacker would need an existing low-privileged account or other low-privileged access to the affected WordPress site.
What versions are affected?
JetEngine versions through 3.9.0 are affected. The available data does not identify a fixed version.
What is the potential impact?
Successful exploitation can expose confidential data and has a scope change, meaning impacts may extend beyond the vulnerable component. The CVSS vector also indicates a low availability impact and no integrity impact.