CVE-2026-4352
Published: 14 April 2026
Summary
CVE-2026-4352 is a high-severity SQL Injection (CWE-89) vulnerability in Crocoblock (inferred from references). Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 10.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-4352 is a SQL injection vulnerability in the JetEngine plugin for WordPress, affecting all versions up to and including 3.8.6.1. The flaw exists in the Custom Content Type (CCT) REST API search endpoint, where the `_cct_search` parameter is directly interpolated into a SQL query string using `sprintf()` without sanitization or prepared statements like `$wpdb->prepare()`. This issue is exacerbated by WordPress REST API's `wp_unslash()` function on `$_GET` parameters, which strips `wp_magic_quotes()` protection and enables single-quote-based injections. Exploitation requires the Custom Content Types module to be enabled with at least one CCT configured with a public REST GET endpoint.
Unauthenticated attackers can exploit this vulnerability remotely over the network with low complexity and no privileges. By appending malicious SQL queries to existing ones, they can extract sensitive information from the database. The CVSS v3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting high confidentiality impact with no integrity or availability disruption, and it maps to CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).
For mitigation details, refer to advisories from the plugin vendor at https://crocoblock.com/plugins/jetengine/ and Wordfence threat intelligence at https://www.wordfence.com/threat-intel/vulnerabilities/id/29a5701f-92f7-4a02-a990-b189a381cff5?source=cve. The vulnerability was published on 2026-04-14.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-22195
Vulnerability details
The JetEngine plugin for WordPress is vulnerable to SQL Injection via the Custom Content Type (CCT) REST API search endpoint in all versions up to, and including, 3.8.6.1. This is due to the `_cct_search` parameter being interpolated directly into a…
more
SQL query string via `sprintf()` without sanitization or use of `$wpdb->prepare()`. WordPress REST API's `wp_unslash()` call on `$_GET` strips the `wp_magic_quotes()` protection, allowing single-quote-based injection. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The Custom Content Types module must be enabled with at least one CCT configured with a public REST GET endpoint for exploitation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing WordPress REST API endpoint directly enables T1190 for remote unauthenticated exploitation and sensitive data extraction from the database.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates input validation and sanitization of the _cct_search parameter before interpolation into SQL queries, preventing SQL injection exploitation.
Requires identification and timely patching of the SQL injection flaw in JetEngine plugin versions up to 3.8.6.1.
Provides vulnerability scanning to detect SQL injection issues like CVE-2026-4352 in WordPress plugins and trigger remediation.