{"id":"CVE-2026-39736","kind":"vulnerability","aliases":["CVE-2026-39736"],"related":[],"title":"JetEngine WordPress plugin: SQL injection lets attackers read or change database","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows SQL Injection.This issue affects JetEngine: from n/a through 3.9.0.1.","summary":"Crocoblock JetEngine, a WordPress plugin for custom content and listings, has an SQL injection flaw in versions up to and including 3.9.0.1. An attacker who can send crafted input to the affected feature can run SQL queries against the site's database.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"jet-engine","fixed":[],"affected":"<= 3.9.0.1","ecosystem":"wordpress"}],"ecosystems":[],"tags":["crocoblock","jetengine","runtime","wordpress","wordpress-plugin"],"not_affected_if":["jetengine-not-installed"],"how_to_check":"- Check the installed JetEngine plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/jet-engine/jet-engine.php`.\n- Treat any version at or below `3.9.0.1` as affected.","fix":null,"status":"open","published_at":"2026-10-29T14:17:54+00:00","first_seen_at":"2026-10-29T14:25:23+00:00","triaged_at":"2026-10-29T14:25:56+00:00","updated_at":"2026-10-29T14:26:40+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-29T14:25:56Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"JetEngine WordPress plugin: SQL injection lets attackers read or change database","impact":"high","summary":"Crocoblock JetEngine, a WordPress plugin for custom content and listings, has an SQL injection flaw in versions up to and including 3.9.0.1. An attacker who can send crafted input to the affected feature can run SQL queries against the site's database.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["wordpress","jetengine","crocoblock"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Database contents readable or modifiable through injected SQL queries","analyst_note":"Find the fixed version and the vulnerable endpoint or feature from the vendor advisory or the Wordfence/WPScan record; NVD gives only the range through 3.9.0.1.","how_to_check":"- Check the installed JetEngine plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/jet-engine/jet-engine.php`.\n- Treat any version at or below `3.9.0.1` as affected.","plain_action":"","needs_analyst":true,"not_affected_if":["jetengine-not-installed"],"who_is_affected":"Sites running the JetEngine WordPress plugin at version 3.9.0.1 or earlier are in scope according to the NVD description. The sources do not say which feature or request path is reachable, or whether authentication is required. Sites that do not run JetEngine are not affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.0007,"input_tokens":4118,"output_tokens":577,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed version and the vulnerable endpoint or feature from the vendor advisory or the Wordfence/WPScan record; NVD gives only the range through 3.9.0.1.","search":"'-2026':13A,16A '-39736':14A,17A '3.9.0.1':49B,98C 'affect':59B,93C 'allow':89C 'attack':7A,51B 'chang':10A 'command':79C 'content':35B 'craft':55B 'crocoblock':21B,28B,84C 'custom':34B 'cve':12A,15A 'databas':11A,69B 'element':74C 'engin':88C 'engine':20A 'featur':60B 'flaw':42B 'improp':70C 'includ':48B 'inject':5A,41B,81C 'injection.this':91C 'input':56B 'issu':92C 'jet':19A,87C 'jet-engin':86C 'jet-engine':18A 'jetengin':1A,22B,29B,85C,94C 'let':6A 'list':37B 'n/a':96C 'neutral':71C 'plugin':3A,27B,32B 'queri':64B 'read':8A 'run':62B 'runtim':23B 'send':54B 'site':67B 'special':73C 'sql':4A,40B,63B,78C,80C,90C 'use':75C 'version':44B 'vulner':82C 'wordpress':2A,24B,26B,31B 'wordpress-plugin':25B","nicknames":[],"mitigations":[],"who_affected":"Sites running the JetEngine WordPress plugin at version 3.9.0.1 or earlier are in scope according to the NVD description. The sources do not say which feature or request path is reachable, or whether authentication is required. Sites that do not run JetEngine are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T14:17:54+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-39736","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39736","severity":null,"published_at":"2026-10-29T14:17:54+00:00","modified_at":"2026-10-29T14:17:54+00:00","first_seen_at":"2026-10-29T14:25:23+00:00","fetched_at":"2026-10-29T14:25:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-39736:1028","url":null,"severity":null,"published_at":"2026-10-29T14:26:40+00:00","modified_at":"2026-10-29T14:26:40+00:00","first_seen_at":"2026-10-29T14:26:40+00:00","fetched_at":"2026-10-29T14:26:40+00:00","note":"No vendor/Wordfence/Patchstack record for this exact CVE id found in search; NVD page not readable. Fix unknown: 3.9.0.2 is the next release after 3.9.0.1 but its changelog (third-party mirror) lists only permission hardening, so I cannot tie it to this CVE. Endpoint unknown. Sibling CVE-2026-115608 (JetEngine <=3.9.0, fixed 3.9.0.1) is a different record. Settle by reading the Patchstack/Wordfence entry for this id or Crocoblock changelog. Nothing verified."}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}