CVE-2026-4662: JetEngine <= 3.8.6.1 - Unauthenticated SQL Injection via Listing Grid 'filtered_query' Parameter
The JetEngine plugin for WordPress is vulnerable to SQL Injection via the listingloadmore AJAX action in all versions up to, and including, 3.8.6.1. This is due to the filteredquery parameter being excluded from the HMAC signature validation (allowing attacker-controlled input to bypass security checks) combined with the preparewhereclause() method in the SQL Query Builder not sanitizing the compare operator before concatenating it into SQL statements. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database, provided the site has a JetEngine Listing Grid with Load More enabled that uses a SQL Query Builder query.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4662?
CVE-2026-4662 has a high severity rating due to its potential for unauthenticated SQL Injection attacks.
How do I fix CVE-2026-4662?
To fix CVE-2026-4662, you should update the JetEngine plugin to version 3.8.6.2 or later.
What versions of JetEngine are affected by CVE-2026-4662?
CVE-2026-4662 affects all versions of JetEngine up to and including 3.8.6.1.
What exploits are associated with CVE-2026-4662?
CVE-2026-4662 can be exploited to execute unauthorized SQL queries due to insecure handling of the 'filtered_query' parameter.
Is user authentication required to exploit CVE-2026-4662?
No, CVE-2026-4662 can be exploited without user authentication.