CVE-2026-4352: JetEngine WordPress Plugin SQLi Vulnerability

CVE-2026-4352 Overview

The JetEngine plugin for WordPress is vulnerable to SQL Injection via the Custom Content Type (CCT) REST API search endpoint in all versions up to, and including, 3.8.6.1. This vulnerability allows unauthenticated attackers to append additional SQL queries into existing queries, potentially extracting sensitive information from the database.

Critical Impact

Unauthenticated attackers can exploit this SQL injection vulnerability to extract sensitive data from the WordPress database, including user credentials, personal information, and other confidential data stored within Custom Content Types.

Affected Products

• JetEngine plugin for WordPress versions up to and including 3.8.6.1
• WordPress sites with the Custom Content Types module enabled
• CCT configurations with public REST GET endpoints

Discovery Timeline

• 2026-04-14 - CVE-2026-4352 published to NVD
• 2026-04-14 - Last updated in NVD database

Technical Details for CVE-2026-4352

Vulnerability Analysis

This SQL Injection vulnerability (CWE-89) exists within the JetEngine plugin's Custom Content Type REST API search functionality. The root issue stems from improper handling of user-supplied input in the search endpoint, where the _cct_search parameter is directly interpolated into SQL query strings without proper sanitization.

The vulnerability is particularly dangerous because it can be exploited by unauthenticated users with network access. Successful exploitation allows attackers to read confidential data from the database. However, the attack does not allow modification of data or disruption of service availability.

For exploitation to be successful, specific conditions must be met: the Custom Content Types module must be enabled, and at least one CCT must be configured with a public REST GET endpoint.

Root Cause

The vulnerability originates from insecure coding practices in the search parameter handling. The _cct_search parameter is interpolated directly into a SQL query string via sprintf() without any sanitization or use of WordPress's secure $wpdb->prepare() method.

Additionally, WordPress's REST API architecture contributes to the vulnerability—the wp_unslash() call on $_GET parameters strips the wp_magic_quotes() protection that would normally escape single quotes. This bypass of WordPress's built-in protection mechanisms enables single-quote-based SQL injection attacks.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can craft malicious HTTP requests to the CCT REST API search endpoint, injecting SQL payloads through the _cct_search parameter.

The exploitation process involves sending specially crafted GET requests to the vulnerable endpoint with SQL injection payloads. The unsanitized input is then executed as part of the database query, allowing attackers to use techniques such as UNION-based injection or time-based blind SQL injection to extract database contents.

For detailed technical analysis of this vulnerability, refer to the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-4352

Indicators of Compromise

• Unusual or malformed requests to CCT REST API endpoints containing SQL syntax such as single quotes, UNION statements, or comment sequences
• Database query logs showing unexpected SELECT statements or UNION-based queries originating from REST API requests
• Web server access logs with encoded SQL injection payloads in the _cct_search parameter

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in REST API requests
• Monitor REST API endpoint access logs for suspicious query parameters containing SQL keywords or special characters
• Configure intrusion detection systems (IDS) to alert on SQL injection signature patterns targeting WordPress REST APIs
• Review JetEngine plugin logs and WordPress debug logs for database query errors or unusual query patterns

Monitoring Recommendations

• Enable detailed logging for WordPress REST API requests, particularly for JetEngine CCT endpoints
• Set up real-time alerting for database errors or anomalous query execution times that may indicate time-based SQL injection attempts
• Monitor for bulk data exfiltration patterns that could indicate successful exploitation

How to Mitigate CVE-2026-4352

Immediate Actions Required

• Update the JetEngine plugin to the latest patched version immediately
• If updates cannot be applied immediately, disable public REST API access for Custom Content Types
• Review database audit logs for signs of exploitation or unauthorized data access
• Consider temporarily disabling the Custom Content Types module until patching is complete

Patch Information

Plugin users should update to a version of JetEngine that includes proper input sanitization using $wpdb->prepare() for the _cct_search parameter. Check the Crocoblock JetEngine Plugin page for the latest security updates and release notes.

The fix should implement parameterized queries using WordPress's $wpdb->prepare() method instead of direct string interpolation via sprintf(). This ensures that user-supplied input is properly escaped before being included in SQL queries.

Workarounds

• Disable public REST API access for all Custom Content Types by removing GET endpoint access from CCT configurations
• Implement a WAF rule to filter requests containing SQL injection patterns in the _cct_search parameter
• Use WordPress security plugins to add additional input validation layers for REST API endpoints
• Restrict access to CCT REST endpoints to authenticated users only until the plugin is patched

# WordPress .htaccess rule to block suspicious _cct_search parameters
# Add to your WordPress .htaccess file as a temporary mitigation
RewriteEngine On
RewriteCond %{QUERY_STRING} _cct_search=.*(\%27|\'|\%22|\"|union|select|from|where) [NC]
RewriteRule .* - [F,L]