CVE-2026-12360 Overview
CVE-2026-12360 is an unauthenticated SQL injection vulnerability in the JetEngine plugin for WordPress, affecting all versions up to and including 3.8.10.1. The flaw resides in the listing_load_more AJAX handler, which accepts a filtered_query parameter that is intentionally excluded from the HMAC query signature check. Because meta_query row values inside filtered_query are merged into SQL construction without sanitization, attackers can perform time-based or boolean blind SQL injection by appending malicious meta_query values to a Load More AJAX request captured from any public Listing Grid page. The vulnerability is tracked under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).
Critical Impact
Unauthenticated attackers can extract sensitive database contents, including user credentials and configuration data, from any WordPress site running a vulnerable JetEngine version with a public Listing Grid.
Affected Products
- JetEngine plugin for WordPress, all versions up to and including 3.8.10.1
- WordPress sites publishing any Listing Grid using JetEngine
- Crocoblock-developed JetEngine component for Elementor and Bricks integrations
Discovery Timeline
- 2026-06-17 - CVE-2026-12360 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-12360
Vulnerability Analysis
The JetEngine plugin exposes an AJAX endpoint named listing_load_more that powers the front-end Load More pagination feature on Listing Grid widgets. To support dynamic filter integrations, the plugin signs most query parameters with an HMAC. The filtered_query parameter is explicitly excluded from this signature validation so that third-party filter plugins can inject runtime filter state.
The filtered_query payload contains a meta_query structure that is forwarded into the JetEngine query builder. Within the meta query trait, individual row values are concatenated into SQL fragments without proper escaping or parameterization. An unauthenticated attacker who captures a Load More request from any public listing page can replay it with a crafted meta_query row, injecting SQL syntax that the database evaluates directly.
Because the response itself returns HTML rather than raw query output, exploitation typically relies on blind techniques. Attackers can use time-based payloads invoking SLEEP() or boolean payloads that change response content based on conditional logic to enumerate database contents one bit at a time.
Root Cause
The root cause is missing sanitization in the meta query construction logic referenced at includes/components/query-builder/queries/traits/meta-query.php and the AJAX handler at includes/components/listings/ajax-handlers.php. Trust placed in the HMAC signature is bypassed because filtered_query is deliberately exempt, while downstream code assumes the data has been validated.
Attack Vector
Exploitation requires no authentication and no user interaction. An attacker browses to any public page containing a JetEngine Listing Grid, captures the Load More AJAX request, modifies the filtered_query[meta_query] structure with a malicious payload, and replays the request. The injected SQL executes in the context of the WordPress database user, exposing the contents of tables such as wp_users and wp_options.
The vulnerability mechanism is documented in the Wordfence Vulnerability Analysis and the affected source lines are visible in the WordPress JetEngine Code Review.
Detection Methods for CVE-2026-12360
Indicators of Compromise
- POST requests to /wp-admin/admin-ajax.php with action=jet_engine_ajax or action=listing_load_more containing filtered_query[meta_query] parameters with SQL keywords such as SLEEP, BENCHMARK, UNION, SELECT, or IF(
- Unusually long response times on Load More AJAX endpoints, indicating time-based blind SQL injection probes
- Repeated AJAX requests from a single IP address iterating through varying meta_query values, characteristic of blind extraction
- Web server or WAF logs showing URL-encoded SQL syntax inside filtered_query JSON structures
Detection Strategies
- Inspect WordPress admin-ajax.php traffic for filtered_query parameters containing SQL metacharacters, comment sequences (--, #, /*), or time-delay functions
- Correlate response latency anomalies against requesting IP addresses to surface blind injection campaigns
- Enable database query logging on staging mirrors and review for unexpected SLEEP, BENCHMARK, or nested SELECT constructs originating from listing queries
Monitoring Recommendations
- Deploy WAF rules that block SQL keywords and conditional functions inside the filtered_query parameter of JetEngine AJAX requests
- Forward WordPress access logs and PHP error logs into a centralized SIEM or data lake for retrospective hunting against the indicators above
- Alert on bursts of admin-ajax.php POST requests from a single source within short time windows, especially against pages hosting Listing Grids
How to Mitigate CVE-2026-12360
Immediate Actions Required
- Upgrade the JetEngine plugin to a version newer than 3.8.10.1 as published in the Crocoblock Plugin Changelog
- Audit WordPress access logs for prior exploitation attempts containing filtered_query[meta_query] payloads with SQL syntax
- Rotate WordPress administrator passwords and any secrets stored in wp_options if exploitation indicators are found
- Review wp_users table integrity and look for unauthorized account additions or privilege changes
Patch Information
Crocoblock has released a patched build of JetEngine that adds sanitization to meta_query row values before they reach SQL construction. Site administrators should apply the latest version available from the Crocoblock Plugin Changelog or update through the WordPress plugin manager.
Workarounds
- Temporarily disable JetEngine Listing Grid widgets on publicly accessible pages until the patched version is installed
- Deploy a WAF rule that rejects admin-ajax.php requests containing meta_query structures with SQL metacharacters or time-delay functions
- Restrict access to /wp-admin/admin-ajax.php from unauthenticated sources where business requirements permit
- Apply the principle of least privilege to the WordPress database user to limit data exposure if injection succeeds
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
