ZeroDay Findings
Sign inSign up

Findings

CVE-2026-4662

The JetEngine plugin for WordPress is vulnerable to SQL Injection via the AJAX action in all versions up to, and including, 3.8.6.1.

Published Mar 24, 2026 · updated Jun 17, 2026

The JetEngine plugin for WordPress is vulnerable to SQL Injection via the AJAX action in all versions up to, and including, 3.8.6.1. This is due to the parameter being excluded from the HMAC signature validation (allowing attacker-controlled input to bypass security checks) combined with the method in the SQL Query Builder not sanitizing the operator before concatenating it into SQL statements. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database, provided the site has a JetEngine Listing Grid with Load More enabled that uses a SQL Query Builder query.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 24, 2026 · NIST NVD

    Detected

    The JetEngine plugin for WordPress is vulnerable to SQL Injection via the AJAX action in all versions up to, and including, 3.8.6.1. This is due to the parameter being excluded from the HMAC signature validation (allowing attacker-controlled input to bypass security checks) combined with the method in the SQL Query Builder not sanitizing the operator before concatenating it into SQL statements. Th

  2. Jun 17, 2026 · NIST NVD

    Updated

    The JetEngine plugin for WordPress is vulnerable to SQL Injection via the AJAX action in all versions up to, and including, 3.8.6.1. This is due to the parameter being excluded from the HMAC signature validation (allowing attacker-controlled input to bypass security checks) combined with the method in the SQL Query Builder not sanitizing the operator before concatenating it into SQL statements. Th

Sources

  • CVE.orgVulnerability recordCVE-2026-4662

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-4662

    The JetEngine plugin for WordPress is vulnerable to SQL Injection via the AJAX action in all versions up to, and including, 3.8.6.1. This is due to the parameter being excluded from the HMAC signature validation (allowing attacker-controlled i

    nvd.nist.gov

References