Description
Unauthenticated SQL Injection in JetEngine < 3.8.9.1 versions.
Published: 2026-06-17
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an unauthenticated SQL Injection that allows attackers to inject arbitrary SQL commands into the JetEngine plugin's database queries. This flaw, classified as CWE-89, can enable attackers to retrieve, modify, or delete sensitive data from the WordPress site's database, potentially leading to data exposure or corruption.

Affected Systems

Any WordPress site using JetEngine versions prior to 3.8.9.1 is affected. The plugin, provided by Jetimpex Inc., is widely used for dynamic content generation, and these vulnerable releases lack proper input sanitization and parameterized queries.

Risk and Exploitability

The CVSS score of 9.3 indicates critical severity. The EPSS score is not available, so the current exploitation rate is unknown, but the lack of a KEV listing does not mitigate the risk, as the flaw remains actively exploitable with web-based vectors. Attackers can trigger the injection by submitting crafted requests to the plugin's endpoints without authentication, making the vulnerability highly accessible.

Generated by OpenCVE AI on June 18, 2026 at 12:08 UTC.

Remediation

Vendor Solution

Update the WordPress JetEngine Plugin to the latest available version (at least 3.8.9.1).

OpenCVE Recommended Actions

  • Update the WordPress JetEngine Plugin to version 3.8.9.1 or newer.
  • Restrict the WordPress database user to the minimal privileges required for normal operation, removing unnecessary SELECT, UPDATE, DELETE, and INSERT rights that are not needed by the site.
  • Deploy a web application firewall or security plugin configured to detect and block suspicious SQL injection patterns targeting the JetEngine plugin endpoints.

Generated by OpenCVE AI on June 18, 2026 at 12:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 21 Jun 2026 09:45:00 +0000

Type Values Removed Values Added
First Time appeared Jetimpex Inc.
Jetimpex Inc. jetengine
Wordpress
Wordpress wordpress
Vendors & Products Jetimpex Inc.
Jetimpex Inc. jetengine
Wordpress
Wordpress wordpress

Fri, 19 Jun 2026 00:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 17 Jun 2026 11:15:00 +0000

Type Values Removed Values Added
Description Unauthenticated SQL Injection in JetEngine < 3.8.9.1 versions.
Title WordPress JetEngine plugin < 3.8.9.1 - SQL Injection vulnerability
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 9.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L'}

Subscriptions

Jetimpex Inc. Jetengine
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-06-17T15:34:15.561Z

Reserved: 2026-05-27T10:27:09.956Z

Link: CVE-2026-49084

cve-icon Vulnrichment

Updated: 2026-06-17T15:34:08.189Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-20T23:03:54Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')