The JetEngine WordPress plugin contains an injection flaw in the listing_load_more AJAX handler. The filtered_query parameter, used to deliver front‑end filter selections, bypasses the HMAC signature check and its meta_query values are not sanitized. An unauthenticated user can supply a crafted meta_query payload that is directly merged into an SQL statement, enabling time‑based or boolean blind SQL injection. This allows the attacker to retrieve sensitive data, exfiltrate database contents, or potentially alter data, compromising data confidentiality and integrity. The flaw is a classic SQL injection weakness, classified as CWE‑89.

All installations of Crocoblock JetEngine version 3.8.10.1 or earlier are affected. The vulnerability applies to WordPress sites that have the JetEngine plugin enabled and expose public Listing Grid pages.

The CVSS score of 7.5 indicates a high severity impact. The EPSS score is less than 1 %, implying a low likelihood of observed exploitation at this time, and the vulnerability is not listed in CISA’s KEV catalog. However, the unauthenticated nature and web‑surface exposure (any public Listing Grid page) mean that the attack path is straightforward for an automated scanner or attacker with knowledge of the site structure. If exploited, the attacker can read arbitrary database tables, potentially leading to data loss or further compromise.