---
id: "CVE-2026-115608"
kind: "vulnerability"
aliases: ["CVE-2026-115608"]
title: "JetEngine WordPress plugin: SQL injection lets attackers read or change database"
severity: "high"
cvss: 8.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["crocoblock", "jetengine", "package", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-26T11:16:35+00:00"
first_seen_at: "2026-10-26T11:29:40+00:00"
updated_at: "2026-10-26T11:30:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115608", "first_seen_at": "2026-10-26T11:29:40+00:00"}]
---

# JetEngine WordPress plugin: SQL injection lets attackers read or change database

JetEngine, a WordPress plugin from Crocoblock, has an SQL injection flaw in versions through 3.9.0. An attacker can inject SQL commands that the plugin passes to the database, which can expose or alter site data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed JetEngine version in the WordPress admin plugin list or with `wp plugin get jet-engine --field=version`
- Confirm whether the version is `3.9.0` or older

## Fix

- Update JetEngine to a version later than `3.9.0` once the vendor release is confirmed (unknown in the sources)
- If no fixed version is available, deactivate the plugin until it is patched

## Timeline

- 2026-10-26T11:29:40+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115608

## From the sources

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows SQL Injection.This issue affects JetEngine: from n/a through 3.9.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_