{"id":"CVE-2026-115608","kind":"vulnerability","aliases":["CVE-2026-115608"],"related":[],"title":"JetEngine WordPress plugin: SQL injection lets attackers read or change database","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows SQL Injection.This issue affects JetEngine: from n/a through 3.9.0.","summary":"JetEngine, a WordPress plugin from Crocoblock, has an SQL injection flaw in versions through 3.9.0. An attacker can inject SQL commands that the plugin passes to the database, which can expose or alter site data.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["crocoblock","jetengine","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed JetEngine version in the WordPress admin plugin list or with `wp plugin get jet-engine --field=version`\n- Confirm whether the version is `3.9.0` or older","fix":"- Update JetEngine to a version later than `3.9.0` once the vendor release is confirmed (unknown in the sources)\n- If no fixed version is available, deactivate the plugin until it is patched","status":"open","published_at":"2026-10-26T11:16:35+00:00","first_seen_at":"2026-10-26T11:29:40+00:00","triaged_at":"2026-10-26T11:30:56+00:00","updated_at":"2026-10-26T11:30:56+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T11:30:56Z","model":"claude-haiku-5-5","output":{"fix":"- Update JetEngine to a version later than `3.9.0` once the vendor release is confirmed (unknown in the sources)\n- If no fixed version is available, deactivate the plugin until it is patched","reach":"internet","title":"JetEngine WordPress plugin: SQL injection lets attackers read or change database","impact":"high","summary":"JetEngine, a WordPress plugin from Crocoblock, has an SQL injection flaw in versions through 3.9.0. An attacker can inject SQL commands that the plugin passes to the database, which can expose or alter site data.","category":"package","nicknames":[],"who_cares":["wordpress","jetengine","crocoblock"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads or modifies site database contents through injected SQL","analyst_note":"Confirm the fixed JetEngine version and whether the injection is reachable without authentication, using the NVD entry and the Crocoblock changelog.","how_to_check":"- Check the installed JetEngine version in the WordPress admin plugin list or with `wp plugin get jet-engine --field=version`\n- Confirm whether the version is `3.9.0` or older","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the JetEngine plugin at version 3.9.0 or earlier are affected. The sources do not say which page or request path is reachable without login, so the exposed surface is unknown. Sites that do not use JetEngine can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000611,"input_tokens":3308,"output_tokens":560,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-115608':14A,17A '-2026':13A,16A '3.9.0':36B,85C 'affect':80C 'allow':76C 'alter':54B 'attack':7A,38B 'chang':10A 'command':42B,66C 'crocoblock':18B,27B,71C 'cve':12A,15A 'data':56B 'databas':11A,49B 'element':61C 'engin':75C 'expos':52B 'flaw':32B 'improp':57C 'inject':5A,31B,40B,68C 'injection.this':78C 'issu':79C 'jet':74C 'jet-engin':73C 'jetengin':1A,19B,22B,72C,81C 'let':6A 'n/a':83C 'neutral':58C 'packag':20B 'pass':46B 'plugin':3A,25B,45B 'read':8A 'site':55B 'special':60C 'sql':4A,30B,41B,65C,67C,77C 'use':62C 'version':34B 'vulner':69C 'wordpress':2A,21B,24B","nicknames":[],"mitigations":[],"who_affected":"Sites running the JetEngine plugin at version 3.9.0 or earlier are affected. The sources do not say which page or request path is reachable without login, so the exposed surface is unknown. Sites that do not use JetEngine can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T11:16:35+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115608","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115608","severity":null,"published_at":"2026-10-26T11:16:35+00:00","modified_at":"2026-10-26T11:16:35+00:00","first_seen_at":"2026-10-26T11:29:40+00:00","fetched_at":"2026-10-26T11:29:40+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}