WordPress security changelog
HIGH CVE-2026-12360 Deferred

JetEngine: SQL injection

JetEngine is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data. The published affected range is <= 3.8.10.1.

CVE / CNA score 7.5 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
JetEngine
Plugin slug
jet-engine
Affected
<= 3.8.10.1
Safe version
> 3.8.10.1
Published
Jun 17, 2026
Weakness
CWE-89 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

This CVE was published Jun 17, 2026 and is one of 26 known issues for this plugin.

What to do

Patch or disable the affected component.

Update JetEngine to a release after 3.8.10.1, or disable and remove it until a fixed version is available.

Source record

Technical description

The JetEngine plugin for WordPress is vulnerable to SQL injection in all versions up to and including 3.8.10.1. The listing_load_more AJAX handler accepts a filtered_query parameter that is intentionally excluded from the HMAC query signature check to support front-end filter integration. However, meta_query row values within filtered_query are not sanitized before being merged into SQL construction. This makes it possible for unauthenticated attackers to perform time-based or boolean blind SQL injection by appending a malicious meta_query value to a Load More AJAX request captured from any public Listing Grid page.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

Primary and upstream sources