---
id: "CVE-2026-39736"
kind: "vulnerability"
aliases: ["CVE-2026-39736"]
title: "JetEngine WordPress plugin: SQL injection lets attackers read or change database"
severity: "high"
cvss: 8.5
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "jet-engine", "fixed": [], "affected": "<= 3.9.0.1", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["crocoblock", "jetengine", "runtime", "wordpress", "wordpress-plugin"]
not_affected_if: ["jetengine-not-installed"]
published_at: "2026-10-29T14:17:54+00:00"
first_seen_at: "2026-10-29T14:25:23+00:00"
updated_at: "2026-10-29T14:26:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39736", "first_seen_at": "2026-10-29T14:25:23+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-29T14:26:40+00:00"}]
---

# JetEngine WordPress plugin: SQL injection lets attackers read or change database

Crocoblock JetEngine, a WordPress plugin for custom content and listings, has an SQL injection flaw in versions up to and including 3.9.0.1. An attacker who can send crafted input to the affected feature can run SQL queries against the site's database.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:jet-engine affected <= 3.9.0.1 fixed ?

## How to check

- Check the installed JetEngine plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/jet-engine/jet-engine.php`.
- Treat any version at or below `3.9.0.1` as affected.

## Timeline

- 2026-10-29T14:25:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-39736
- 2026-10-29T14:26:40+00:00 analyst — No vendor/Wordfence/Patchstack record for this exact CVE id found in search; NVD page not readable. Fix unknown: 3.9.0.2 is the next release after 3.9.0.1 but its changelog (third-party mirror) lists only permission hardening, so I cannot tie it to this CVE. Endpoint unknown. Sibling CVE-2026-115608 (JetEngine <=3.9.0, fixed 3.9.0.1) is a different record. Settle by reading the Patchstack/Wordfence entry for this id or Crocoblock changelog. Nothing verified.

## From the sources

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows SQL Injection.This issue affects JetEngine: from n/a through 3.9.0.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_