CVE-2026-54187: JetEngine SQL Injection Vulnerability

CVE-2026-54187 Overview

CVE-2026-54187 is an unauthenticated SQL injection vulnerability affecting the JetEngine WordPress plugin in versions up to and including 3.8.10.1. The flaw is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command). Remote attackers can inject SQL statements without authentication or user interaction. Successful exploitation allows attackers to extract sensitive database contents and impact site availability. The vulnerability carries a CVSS 3.1 base score of 9.3, reflecting network-based exploitation with no privileges required and a scope change.

Critical Impact
Unauthenticated attackers can execute arbitrary SQL queries against the WordPress database, exposing user records, credentials, and configuration data on any site running a vulnerable JetEngine release.

Affected Products

JetEngine plugin for WordPress, versions <= 3.8.10.1
WordPress sites using JetEngine for dynamic content, custom post types, and listings
Multisite WordPress installations with JetEngine network-activated

Discovery Timeline

2026-06-17 - CVE-2026-54187 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-54187

Vulnerability Analysis

The vulnerability resides in JetEngine, a widely deployed WordPress plugin that builds dynamic content structures, custom queries, and listings. The plugin fails to properly neutralize user-supplied input before incorporating it into SQL statements. Because the affected request paths do not require authentication, any remote attacker reaching the WordPress site can deliver crafted payloads.

The issue is tracked as a Patchstack-reported SQL injection. Exploitation does not require user interaction, and the scope is reported as changed, meaning impact extends beyond the vulnerable component to the underlying database. While confidentiality impact is high, integrity is rated none and availability is rated low, indicating that primary risk is data extraction rather than direct write tampering.

Root Cause

The root cause is improper neutralization of input passed into SQL queries. JetEngine concatenates or otherwise embeds attacker-controlled values into database queries without using parameterized statements or applying wpdb::prepare() with correct placeholders. Standard WordPress sanitization functions such as sanitize_text_field() do not prevent SQL injection and cannot substitute for prepared statements.

Attack Vector

Attacks originate over the network against the WordPress HTTP endpoint exposing the vulnerable JetEngine functionality. The attacker sends a crafted request containing SQL syntax in a parameter that flows into a database query. The injected clause modifies the query logic, enabling techniques such as UNION-based extraction, boolean-based blind inference, or time-based blind inference. No credentials, tokens, or prior session state are required.

No verified public proof-of-concept code is currently linked in the NVD record. Refer to the Patchstack SQL Injection Vulnerability advisory for additional technical context.

Detection Methods for CVE-2026-54187

Indicators of Compromise

Unusual HTTP requests to JetEngine endpoints containing SQL keywords such as UNION, SELECT, SLEEP(, BENCHMARK(, or encoded variants.
Database error strings returned in HTTP responses referencing wpdb, MySQL, or syntax errors near JetEngine query parameters.
Spikes in slow responses on /wp-admin/admin-ajax.php or REST routes registered by JetEngine, indicating time-based blind injection probing.
New or modified WordPress administrator accounts and unexpected reads of the wp_users and wp_usermeta tables.

Detection Strategies

Inspect web server and WordPress access logs for query strings containing SQL meta-characters targeting JetEngine routes and AJAX actions.
Enable WordPress database query logging in staging to baseline JetEngine queries, then alert on deviations such as queries with attacker-controlled ORDER BY or appended UNION clauses.
Deploy a web application firewall ruleset with signatures for SQL injection patterns and tune it for the WordPress REST API and admin-ajax.php surface.

Monitoring Recommendations

Forward WordPress, web server, and WAF logs into a centralized analytics pipeline and correlate with authentication and database events.
Monitor outbound database connections and unexpected dumps of large result sets from the WordPress MySQL user.
Track plugin inventory and version drift across WordPress fleets so unpatched JetEngine installations are flagged automatically.

How to Mitigate CVE-2026-54187

Immediate Actions Required

Update JetEngine to a version above 3.8.10.1 on every WordPress site, including staging and disaster recovery environments.
Audit the wp_users, wp_usermeta, and wp_options tables for unauthorized changes and rotate WordPress secrets in wp-config.php.
Force password resets for all administrator and editor accounts and invalidate active sessions.
Review recent web server logs for SQL injection probing against JetEngine endpoints during the exposure window.

Patch Information

Apply the vendor-supplied JetEngine release that remediates this issue. Patch details and fixed version metadata are tracked in the Patchstack SQL Injection Vulnerability advisory. After updating, clear object and page caches so cached responses do not mask the patched behavior.

Workarounds

Restrict access to JetEngine endpoints with a WAF rule blocking SQL injection payload patterns until the plugin is updated.
Temporarily deactivate JetEngine on internet-facing sites that cannot be patched immediately and serve static fallback content.
Apply least privilege to the WordPress database user by removing FILE, CREATE, and DROP privileges where not required.

bash

# Configuration example: WP-CLI update and verification
wp plugin update jet-engine --version=latest
wp plugin get jet-engine --field=version
wp eval 'global $wpdb; var_export($wpdb->get_var("SELECT VERSION()"));'