Description
Unauthenticated SQL Injection in JetSearch <= 3.5.17 versions.
Published: 2026-06-17
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Unauthenticated SQL injection exists in JetSearch plugin versions up to 3.5.17, allowing an attacker to craft malicious input that is executed as part of database queries. This flaw can lead to reading, modification, or deletion of any data stored in the WordPress database and can potentially enable privilege escalation or further compromise of the server.

Affected Systems

Jetimpex Inc. JetSearch plugin for WordPress, versions 3.5.17 and earlier.

Risk and Exploitability

The CVSS score of 9.3 indicates critical severity. No EPSS data is available, so exploitation probability is uncertain, and the vulnerability is not currently listed in CISA KEV. Attacks would typically be carried out by sending specially crafted HTTP requests to the plugin’s input points from any internet-facing WordPress installation that has not yet applied the patch.

Generated by OpenCVE AI on June 18, 2026 at 12:09 UTC.

Remediation

Vendor Solution

Update the WordPress JetSearch Plugin to the latest available version (at least 3.5.17.1).

OpenCVE Recommended Actions

  • Upgrade the JetSearch plugin to version 3.5.17.1 or later
  • Restrict JetSearch functionality to authenticated administrators only by configuring permissions or limiting API endpoints
  • Limit the database permissions used by WordPress to the minimum required for normal operation

Generated by OpenCVE AI on June 18, 2026 at 12:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 21 Jun 2026 09:45:00 +0000

Type Values Removed Values Added
First Time appeared Jetimpex Inc.
Jetimpex Inc. jetsearch
Wordpress
Wordpress wordpress
Vendors & Products Jetimpex Inc.
Jetimpex Inc. jetsearch
Wordpress
Wordpress wordpress

Wed, 17 Jun 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 17 Jun 2026 11:15:00 +0000

Type Values Removed Values Added
Description Unauthenticated SQL Injection in JetSearch <= 3.5.17 versions.
Title WordPress JetSearch plugin <= 3.5.17 - SQL Injection vulnerability
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 9.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L'}

Subscriptions

Jetimpex Inc. Jetsearch
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-06-17T12:19:09.745Z

Reserved: 2026-05-27T10:27:01.187Z

Link: CVE-2026-49079

cve-icon Vulnrichment

Updated: 2026-06-17T12:19:04.466Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-20T23:03:56Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')