CVE-2026-4662
Published: 24 March 2026
Summary
CVE-2026-4662 is a high-severity SQL Injection (CWE-89) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 30.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-4662 is a SQL injection vulnerability in the JetEngine plugin for WordPress, affecting all versions up to and including 3.8.6.1. The flaw exists in the `listing_load_more` AJAX action, where the `filtered_query` parameter is excluded from HMAC signature validation, allowing attacker-controlled input to bypass security checks. Additionally, the `prepare_where_clause()` method in the SQL Query Builder fails to sanitize the `compare` operator before concatenating it into SQL statements. This vulnerability is rated with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and is associated with CWE-89.
Unauthenticated attackers can exploit this vulnerability remotely with low complexity if the target WordPress site uses a JetEngine Listing Grid with Load More enabled that relies on a SQL Query Builder query. By manipulating the `filtered_query` parameter, attackers can append arbitrary SQL queries to existing ones, enabling the extraction of sensitive information from the database, such as user data or other confidential records.
Mitigation details are available in the JetEngine changelog on the Crocoblock website, which documents patches in versions beyond 3.8.6.1. Vulnerable code locations are exposed in the WordPress plugin Trac repository, including files such as `ajax-handlers.php` (line 251), `query.php` (line 125), and `sql.php` (lines 1038 and 962), aiding in verification and patching efforts.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-14743
Vulnerability details
The JetEngine plugin for WordPress is vulnerable to SQL Injection via the `listing_load_more` AJAX action in all versions up to, and including, 3.8.6.1. This is due to the `filtered_query` parameter being excluded from the HMAC signature validation (allowing attacker-controlled input…
more
to bypass security checks) combined with the `prepare_where_clause()` method in the SQL Query Builder not sanitizing the `compare` operator before concatenating it into SQL statements. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database, provided the site has a JetEngine Listing Grid with Load More enabled that uses a SQL Query Builder query.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing WordPress plugin directly enables remote exploitation (T1190) and unauthenticated extraction of database contents (T1213.006).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires identification, reporting, and timely remediation of flaws like the SQL injection in JetEngine's listing_load_more AJAX action, directly addressed by patches in versions beyond 3.8.6.1.
Enforces validation of attacker-controlled inputs such as the filtered_query parameter and compare operator to block SQL injection via unsanitized concatenation in prepare_where_clause().
Provides boundary protection through web application firewalls or similar to monitor and filter malicious SQL payloads targeting the vulnerable AJAX endpoint.