CVE-2026-115608
HighCVSS 8.5Summary
The Crocoblock JetEngine WordPress plugin in versions up to 3.9.0 contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This may allow an attacker to inject malicious SQL code.
Risk Assessment
The SQL injection vulnerability may allow an attacker to read or modify data in the WordPress database, risking information disclosure and site takeover. The plugin is widely used, increasing the risk.
Recommendation
Update the JetEngine plugin to a version later than 3.9.0 when available. Until then, consider disabling the plugin or deploying WAF rules to block SQL injection attempts.
Other vulnerabilities in JetEngine
See all- CVE-2026-39735Medium
The JetEngine plugin by Crocoblock (up to version 3.9.0.1) contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
- CVE-2026-97238Medium
Cross Site Scripting (XSS) vulnerability in JetEngine up to version 3.8.14.3. A subscriber can inject malicious scripts.
- CVE-2026-66613Critical
Unauthenticated remote code execution (RCE) vulnerability in JetEngine plugin versions up to and including 3.8.14. An attacker can execute arbitrary code on the server without logging in.
- CVE-2026-56068Critical
The JetEngine plugin for WordPress versions 3.8.10.2 and earlier contains an SQL injection vulnerability that can be exploited by an unauthenticated attacker. This vulnerability allows unauthorized database queries to be executed.
- CVE-2026-54187Critical
There is an unauthenticated SQL injection vulnerability in JetEngine versions <= 3.8.10.1.
- CVE-2026-52706Critical
There is an unauthenticated PHP object injection vulnerability in JetEngine versions up to 3.8.10.
- CVE-2026-49084Critical
JetEngine versions below 3.8.9.1 are vulnerable to unauthenticated SQL injection.
- CVE-2026-49076Critical
The Crocoblock JetEngine plugin for WordPress up to version 3.8.9.1 contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This allows an attacker to perform Blind SQL Injection.
- CVE-2026-49075Critical
JetEngine versions up to 3.8.9.1 are vulnerable to PHP Object Injection, which may lead to unauthorized access to data.
- CVE-2026-42774Critical
The JetEngine plugin for WordPress by Crocoblock is vulnerable to SQL Injection. The issue affects all versions up to and including 3.8.8.1. Improper neutralization of special elements used in SQL commands allows an attacker to execute arbitrary SQL queries.
Original NVD description (English source)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows SQL Injection.This issue affects JetEngine: from n/a through 3.9.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS