Security readout for executives and security teams
Plain-English summary
CVE-2026-4662 affects the JetEngine WordPress plugin through a SQL injection flaw. An unauthenticated attacker may be able to read sensitive database information, but only on sites using a JetEngine Listing Grid with Load More enabled and a SQL Query Builder query.
Executive priority
Prioritize review and remediation for public WordPress sites using JetEngine. Business urgency is high where customer, order, user, or proprietary data resides in the same WordPress database and the vulnerable Listing Grid configuration is enabled.
Technical view
The flaw is in the listing_load_more AJAX action. The filtered_query parameter is excluded from HMAC validation, and prepare_where_clause() does not sanitize the compare operator before SQL concatenation. Sources rate it CVSS 7.5, network exploitable, unauthenticated, low complexity, with confidentiality impact.
Likely exposure
Exposure is limited to WordPress sites running JetEngine versions up to and including 3.8.6.1, with the specific Listing Grid and SQL Query Builder configuration described in the CVE. Sites without that configuration may not be practically exposed based on the provided sources.
Exploitation context
No CISA KEV listing or cited source confirms active exploitation. The vulnerability is still serious because it is unauthenticated and could expose database contents when the vulnerable JetEngine configuration is present.
Researcher notes
The supplied sources identify vulnerable code paths in JetEngine 3.8.6.1 and describe the required configuration. Patch details are not explicit in the provided bundle, so remediation should be verified against Crocoblock’s changelog or vendor advisory.
Mitigation direction
- Check Crocoblock guidance and update JetEngine beyond affected versions when available.
- Temporarily disable Load More on affected JetEngine Listing Grids.
- Avoid SQL Query Builder-backed Listing Grids until remediation is confirmed.
- Monitor WordPress AJAX traffic for unusual listing_load_more and filtered_query activity.
Validation and detection
- Inventory WordPress sites using the JetEngine plugin.
- Identify JetEngine installations at version 3.8.6.1 or earlier.
- Find Listing Grids with Load More enabled.
- Confirm whether those grids use SQL Query Builder queries.
- Review logs for suspicious unauthenticated listing_load_more requests.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-89: Database access and collection lookup
Injection into data stores can inform collection, data access, and exfiltration detection reviews. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-4662 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N3.93.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/f10cf49b-1b78-43c1-b0d1-c1dbb74d5696?source=cveCVE reference
- https://plugins.trac.wordpress.org/browser/jet-engine/tags/3.8.6.1/includes/components/query-builder/queries/sql.php#L1038CVE reference
- https://plugins.trac.wordpress.org/browser/jet-engine/tags/3.8.6.1/includes/components/listings/ajax-handlers.php#L251CVE reference
- https://plugins.trac.wordpress.org/browser/jet-engine/tags/3.8.6.1/includes/components/query-builder/listings/query.php#L125CVE reference
- https://crocoblock.com/changelog/?plugin=jet-engineCVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.