Live › vulnerability › CVE-2026-39736
Crocoblock JetEngine, a WordPress plugin for custom content and listings, has an SQL injection flaw in versions up to and including 3.9.0.1. An attacker who can send crafted input to the affected feature can run SQL queries against the site's database.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 14:25 UTC. All times on this page are UTC.
Sites running the JetEngine WordPress plugin at version 3.9.0.1 or earlier are in scope according to the NVD description. The sources do not say which feature or request path is reachable, or whether authentication is required. Sites that do not run JetEngine are not affected.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| jet-engine | wordpress | <= 3.9.0.1 | – |
wp-content/plugins/jet-engine/jet-engine.php.3.9.0.1 as affected.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows SQL Injection.This issue affects JetEngine: from n/a through 3.9.0.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-39736")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.