Crocoblock’s JetEngine plugin for WordPress contains an unauthenticated SQL injection flaw in versions up to 3.8.10.2. An attacker can embed malicious SQL through user‑supplied parameters, allowing arbitrary SELECT, UPDATE, DELETE, or INSERT statements against the database. This enables data theft, modification, or loss, and could ultimately facilitate privilege escalation or destruction of site data. The CWE‑89.

WordPress websites that have the JetEngine plugin installed from Crocoblock or Jetimpex Inc., specifically any installation running version 3.8.10.2 or earlier. Users running a newer release such as 3.8.11 are not affected.

The CVSS v3.1 base score of 9.3 reflects a high severity exploit with no authentication required, affecting confidentiality and integrity. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog. Attackers likely exploit the issue by crafting a request that is processed by the plugin’s query interface, which is exposed to any visitor on the site. Because the vulnerability does not require privileged credentials, the risk is significant for any publicly accessible WordPress deployment that has not applied the patch.