CVE-2026-12360: JetEngine WordPress Plugin SQL Injection Vulnerability

Technical summary

CVE-2026-12360 is a blind SQL injection vulnerability in JetEngine's listing_load_more AJAX handler. The vulnerability exists because the filtered_query parameter is intentionally excluded from HMAC signature validation to support dynamic front-end filtering, but meta_query row values within that parameter are not sanitized before SQL construction. An unauthenticated attacker can append a malicious meta_query value to a captured Load More AJAX request from any public Listing Grid page and perform time-based or boolean-based blind SQL injection. The CWE classification is CWE-89 (SQL Injection).

Business impact

Organizations using JetEngine on WordPress sites face exposure of sensitive database records, including customer data, credentials, or business information accessible through blind SQL injection. While the attacker cannot directly modify or delete data (the vulnerability is read-only), successful exploitation enables reconnaissance of database schema and extraction of confidential information. Public-facing WordPress sites with product listings, directory features, or custom queries are at highest risk. Remediation requires immediate patching, and organizations should monitor for suspicious AJAX requests during the window before patching is complete.

Affected systems

The JetEngine WordPress plugin in all versions up to and including 3.8.10.1 is vulnerable. Any WordPress installation using JetEngine with public Listing Grid pages that enable the Load More feature is affected. The vulnerability is exploitable without authentication, so any publicly accessible WordPress site using vulnerable versions is at risk.

Exploitability

Exploitability is high. The vulnerability requires no authentication, no user interaction, and no special configuration—any public Listing Grid with Load More functionality is exploitable. An attacker only needs to observe a legitimate AJAX Load More request (visible in browser network traffic or client-side code) and modify the meta_query parameter to inject SQL. Blind SQL injection is slower than direct data extraction but is reliable for confirming vulnerability presence and exfiltrating data through time-based or boolean-based inference. No special tools beyond standard HTTP clients are required.

Remediation

Update JetEngine to a patched version released after 3.8.10.1. Verify the exact patched version number in the official JetEngine security advisory or vendor release notes. Until patching is complete, consider temporarily disabling the Load More feature on public Listing Grid pages or restricting AJAX handler access via web application firewall rules. Additionally, review database access logs and query patterns for signs of SQL injection attempts.

Patch guidance

Apply the security update released for JetEngine addressing this vulnerability. Verify the patched version against the official plugin repository or vendor advisory to confirm you have received a version later than 3.8.10.1. Test the patch in a staging environment before production deployment to ensure Listing Grid and Load More functionality continues to work as expected. After patching, confirm that the HMAC signature check or input sanitization has been properly implemented for meta_query values.

Detection guidance

Monitor web server and WordPress logs for unusual AJAX requests to the listing_load_more handler with suspicious characters or SQL syntax in the filtered_query or meta_query parameters (e.g., UNION, SELECT, OR 1=1, time-delay functions). Enable WordPress security logging and query monitoring if available. Network-level WAF rules can flag requests containing SQL keywords targeting AJAX endpoints. Check for unexpected database queries, slow queries, or increased query latency that might indicate blind SQL injection attempts. Baseline normal Load More traffic to distinguish anomalies.

Why prioritize this

This vulnerability scores 7.5 (HIGH) under CVSS 3.1 due to network accessibility, low attack complexity, and no authentication requirements. Confidentiality impact is high (database disclosure), though integrity and availability are not directly affected. The combination of unauthenticated remote exploitability and sensitive data exposure warrants immediate patching. Public WordPress sites are frequently scanned and targeted, and blind SQL injection is actively exploited in the wild.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects an unauthenticated, network-based attack with low complexity and high confidentiality impact. The attack vector is network (AV:N), attack complexity is low (AC:L), privilege escalation is not required (PR:N), and no user interaction is needed (UI:N). Scope is unchanged (S:U), confidentiality is high (C:H), integrity is none (I:N), and availability is none (A:N). The HIGH severity rating aligns with the presence of a widely deployed plugin, public exploitability, and data breach potential.

Frequently asked questions