Improper neutralization of special characters within an SQL command in Crocoblock JetEngine creates a classic SQL Injection flaw. The vulnerability is a CWE-89 weakness that permits an attacker to inject arbitrary SQL statements, potentially exposing sensitive data, altering records, or deleting database contents. Because the flaw stems from unsanitized input, located in plugin code, it can be triggered by a crafted web request.

WordPress installations that use the Crocoblock JetEngine plugin version 3.8.8.1 or earlier are affected. This includes any site that has not applied the 3.8.8.2 update or later. The issue is not limited to a particular WordPress version; any site maintaining the vulnerable plugin copy is at risk.

The CVSS score of 9.3 classifies this as critical, and the flaw can be exploited remotely through the web interface of the plugin. Although an EPSS score is not reported, the high overall severity, absence from the KEV catalog, and the ability to invoke the plugin’s database queries make it a high‑risk vulnerability. An attacker possessing sufficient access to trigger the plugin’s endpoints can achieve full database compromise without additional privileges.