Live › vulnerability › CVE-2026-115608
Go to dashboardJetEngine, a WordPress plugin from Crocoblock, has an SQL injection flaw in versions through 3.9.0. An attacker can inject SQL commands that the plugin passes to the database, which can expose or alter site data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 11:29 UTC. All times on this page are UTC.
Sites running the JetEngine plugin at version 3.9.0 or earlier are affected. The sources do not say which page or request path is reachable without login, so the exposed surface is unknown. Sites that do not use JetEngine can skip it.
No product ranges from the sources yet.
wp plugin get jet-engine --field=version3.9.0 or older3.9.0 once the vendor release is confirmed (unknown in the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows SQL Injection.This issue affects JetEngine: from n/a through 3.9.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-115608")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.