CVE-2026-39736: WordPress JetEngine plugin <= 3.9.0.1 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows SQL Injection.This issue affects JetEngine: from n/a through 3.9.0.1.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress JetEngine pluginto a version that resolves this vulnerability.Fixed in 3.9.0.2
Event History
Frequently Asked Questions
Which JetEngine versions are affected?
JetEngine versions through 3.9.0.1 are affected. The available data does not identify a fixed version.
What level of access does an attacker need?
An attacker needs low-level privileges to exploit the issue. The attack can be performed over the network, requires low complexity, and does not require user interaction.
What is the indicated security impact?
The vulnerability is rated high severity with a CVSS score of 8.5. The vector indicates high confidentiality impact, no integrity impact, and low availability impact.