CVE-2026-42774
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
The JetEngine plugin for WordPress by Crocoblock is vulnerable to SQL Injection. The issue affects all versions up to and including 3.8.8.1. Improper neutralization of special elements used in SQL commands allows an attacker to execute arbitrary SQL queries.
Risk Assessment
An attacker can read, modify, or delete data from the WordPress database, including user data and passwords, leading to full site compromise.
Recommendation
Update the JetEngine plugin to a version newer than 3.8.8.1. If no update is available, temporarily disable the plugin and apply WAF rules to block SQL Injection attacks.
Original NVD description (English source)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine allows SQL Injection. This issue affects JetEngine: from n/a through 3.8.8.1.