The JetEngine plugin for WordPress is susceptible to an unauthenticated SQL injection flaw in the Custom Content Type REST API search endpoint. The internal use of sprintf() to build a query string from the _cct_search parameter without sanitization or prepared statements allows an attacker to inject arbitrary SQL that is appended to the originating query. This can result in the unrestricted extraction of sensitive database content. The weakness is a classic input validation flaw, categorized as CWE-89. The CVSS score of 7.5 indicates a high severity impact for confidentiality and integrity.

The affected product is the Crocoblock JetEngine plugin for WordPress. All releases up to and including 3.8.6.1 are vulnerable. Exploitation requires that the Custom Content Types module be enabled and that at least one content type exposes a public REST GET endpoint. Users running these configurations are at risk.

The vulnerability exposes a high likelihood of exploitation via a straightforward HTTP request to the vulnerable endpoint, and the lack of authentication requirements makes it attractive to attackers. With a CVSS base score of 7.5 and no recorded presence in the CISA KEV catalog, the risk remains significant. An attacker could use the injected payload to read or modify database records, leading to data compromise and potential further compromise of the underlying WordPress installation.