Crocoblock JetEngine Plugin up to 3.8.6.1 on WordPress AJAX Action prepare_where_clause filtered_query sql injection

Summaryinfo

A vulnerability was found in Crocoblock JetEngine Plugin up to 3.8.6.1 on WordPress. It has been classified as critical. Impacted is the function prepare_where_clause of the component AJAX Action Handler. Performing a manipulation of the argument filtered_query results in sql injection. This vulnerability is known as CVE-2026-4662. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as critical has been found in Crocoblock JetEngine Plugin up to 3.8.6.1 on WordPress. This affects the function prepare_where_clause of the component AJAX Action Handler. The manipulation of the argument filtered_query with an unknown input leads to a sql injection vulnerability. CWE is classifying the issue as CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

The JetEngine plugin for WordPress is vulnerable to SQL Injection via the `listing_load_more` AJAX action in all versions up to, and including, 3.8.6.1. This is due to the `filtered_query` parameter being excluded from the HMAC signature validation (allowing attacker-controlled input to bypass security checks) combined with the `prepare_where_clause()` method in the SQL Query Builder not sanitizing the `compare` operator before concatenating it into SQL statements. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database, provided the site has a JetEngine Listing Grid with Load More enabled that uses a SQL Query Builder query.

The weakness was published by Phú. The advisory is shared at wordfence.com. This vulnerability is uniquely identified as CVE-2026-4662 since 03/23/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1505 for this issue.

Upgrading to version 3.8.6.1 eliminates this vulnerability. The upgrade is hosted for download at crocoblock.com.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• Crocoblock

Name

• JetEngine Plugin

Version

• 3.8.6.0
• 3.8.6.1

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion