Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows SQL Injection.This issue affects JetEngine: from n/a through 3.9.0.
Published: 2026-10-26
Score: 8.5 High
EPSS: n/a
KEV: No
Impact: SQL Injection leading to data compromise and possible RCE
Action: Immediate Patch
AI Analysis

Impact

The JetEngine plugin contains an SQL injection flaw that mishandles user input in database queries, enabling attackers to execute arbitrary SQL. This flaw could expose sensitive data, modify records, or in configurations with a high‑privilege database account, potentially elevate to remote code execution.

Affected Systems

Crocoblock JetEngine for WordPress, versions up to and including 3.9.0, are affected. The vulnerability persists in all releases prior to the fix introduced in version 3.9.0.1.

Risk and Exploitability

The CVSS score of 8.5 indicates a high severity issue. EPSS data is not available, and the vulnerability is not listed in CISA KEV, suggesting no widespread public exploits yet. Attackers would need to supply crafted input to the JetEngine plugin, likely via the WordPress admin interface or publicly exposed forms that invoke JetEngine functionality. Successful exploitation could lead to unauthorized data exfiltration, data tampering, or, if database privileges are high, to remote code execution within the site environment.

Generated by OpenCVE AI on October 26, 2026 at 11:21 UTC.

Remediation

Vendor Solution

Update the WordPress JetEngine plugin to the latest available version (at least 3.9.0.1).

OpenCVE Recommended Actions

  • Update the JetEngine plugin to at least version 3.9.0.1.
  • Configure the WordPress database user used by JetEngine with the least privileges required, limiting SELECT/INSERT/UPDATE access to necessary tables only.
  • Implement monitoring and alerting for anomalous SQL activity that could indicate an injection attempt.

Generated by OpenCVE AI on October 26, 2026 at 11:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Crocoblock
Crocoblock jetengine
Wordpress-extensions
Wordpress-extensions jetengine
Vendors & Products Crocoblock
Crocoblock jetengine
Wordpress-extensions
Wordpress-extensions jetengine

Mon, 26 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 26 Oct 2026 10:30:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows SQL Injection.This issue affects JetEngine: from n/a through 3.9.0.
Title WordPress JetEngine plugin <= 3.9.0 - SQL Injection vulnerability
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 8.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L'}

Subscriptions

Crocoblock Jetengine
Wordpress-extensions Jetengine
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-10-26T12:54:34.228Z

Reserved: 2026-10-23T00:18:53.713Z

Link: CVE-2026-115608

cve-icon Vulnrichment

Updated: 2026-10-26T12:46:48.763Z

cve-icon NVD

Status : Deferred

Published: 2026-10-26T11:16:35.190

Modified: 2026-10-26T14:16:31.740

Link: CVE-2026-115608

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-26T17:00:15Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')