CVE-2026-12360: JetEngine <= 3.8.10.1 - Unauthenticated SQL Injection via Listing Grid Load More AJAX Endpoint
The JetEngine plugin for WordPress is vulnerable to SQL injection in all versions up to and including 3.8.10.1. The listingloadmore AJAX handler accepts a filteredquery parameter that is intentionally excluded from the HMAC query signature check to support front-end filter integration. However, metaquery row values within filteredquery are not sanitized before being merged into SQL construction. This makes it possible for unauthenticated attackers to perform time-based or boolean blind SQL injection by appending a malicious metaquery value to a Load More AJAX request captured from any public Listing Grid page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
wordpress/jetenginefrom your environment.Uninstall the JetEngine WordPress plugin if it is not required. The plugin is reported vulnerable in versions up to and including 3.8.10.1; remove it until a vendor patch is available.
- Configuration
Disable the listing_load_more 'Load More' AJAX handler (or any AJAX 'Load More' endpoints that accept a filtered_query parameter) to prevent unauthenticated filtered_query submissions that can lead to SQL injection.
JetEngine (WordPress plugin) listing_load_more_ajax_handler = disabled - Compensating control
Restrict access to public Listing Grid pages and the listing_load_more endpoint until patched — for example require authentication for pages using Listing Grid, or block/limit access at the WAF, web server or firewall (IP allowlist) to prevent unauthenticated attackers from sending filtered_query parameters.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12360?
CVE-2026-12360 has a severity rating of high, with a score of 7.5.
How do I fix CVE-2026-12360?
To fix CVE-2026-12360, update the JetEngine plugin to a version higher than 3.8.10.1.
What type of vulnerability is CVE-2026-12360?
CVE-2026-12360 is an unauthenticated SQL injection vulnerability.
What software is affected by CVE-2026-12360?
CVE-2026-12360 affects the JetEngine plugin for WordPress, specifically versions up to and including 3.8.10.1.
What is the potential impact of CVE-2026-12360?
The potential impact of CVE-2026-12360 includes unauthorized access to sensitive data through SQL injection.