Brief Summary: JetEngine WordPress Plugin CVE-2026-4352 Unauthenticated SQL Injection via CCT REST API

Introduction

An unauthenticated SQL injection in the JetEngine WordPress plugin's Custom Content Type REST API lets any external attacker extract sensitive database contents without credentials or user interaction. On the many WordPress sites that use JetEngine's dynamic content features with publicly exposed CCT endpoints, a search parameter becomes a direct line to the database.

JetEngine, developed by Crocoblock, is a widely used dynamic content plugin for WordPress that integrates with major page builders including Elementor, Gutenberg, Bricks, and Divi. Crocoblock has been building WordPress products since 2018. JetEngine lets developers create custom post types, taxonomies, and REST API endpoints for remote data management. It is popular with WordPress professionals, so this vulnerability matters on a significant number of production sites.

Technical Information

CVE-2026-4352 carries a CVSS 3.1 base score of 7.5 with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The score reflects a network-exploitable flaw with low attack complexity, no required privileges, no user interaction, and high impact to confidentiality. Integrity and availability are not directly affected, but the ability to read arbitrary database contents is a serious data exfiltration risk.

Root Cause

The vulnerability is in the Custom Content Type (CCT) REST API search endpoint. When a request includes the _cct_search parameter, the plugin interpolates its value directly into a SQL query string with PHP's sprintf() function. The value is not sanitized, and the query does not use $wpdb->prepare(), the standard WordPress method for safely formatting SQL queries with parameterized placeholders.

That alone would be a textbook SQL injection, but a detail of WordPress internals makes it reliably exploitable. At bootstrap, WordPress applies wp_magic_quotes() to all superglobals ($_GET, $_POST, $_COOKIE, $_REQUEST), which adds backslash escaping to single quotes and other special characters. Under normal circumstances, this escaping would stop a naive single-quote injection from breaking out of a string context in the SQL query.

The WordPress REST API, however, calls wp_unslash() on all $_GET parameters before passing them to endpoint callbacks. This strips the backslashes that wp_magic_quotes() added, and those backslashes were the only protection between the raw user input and the SQL query. Single quotes reach the sprintf() call unescaped, so an attacker can break out of the intended query structure.

Attack Flow

The exploitation path follows these steps:

1. The attacker identifies a WordPress site running JetEngine with the Custom Content Types module enabled and at least one CCT configured with a public REST GET endpoint. Without a public CCT REST endpoint, the vulnerable code path is not reachable.

2. The attacker sends an unauthenticated HTTP GET request to the CCT REST API search endpoint with a malicious value in the _cct_search parameter. The payload uses single quotes to break out of the original query's string context, followed by additional SQL clauses (such as UNION SELECT statements) that pull data from other database tables.

3. When the request arrives, WordPress's wp_magic_quotes() escapes the single quotes in the $_GET superglobal. The REST API framework then calls wp_unslash(), which removes those escapes before the parameter value reaches the JetEngine endpoint handler.

4. The unescaped, attacker-controlled value goes into sprintf() and is interpolated directly into the SQL query string. The injected SQL runs against the WordPress database, and the results come back in the REST API response.

5. The attacker can repeat the process to extract sensitive information from the database, including user credentials, email addresses, configuration data, and any other content stored in the WordPress database.

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), which accurately describes the failure to sanitize user input before embedding it in a SQL statement.

Configuration Dependency

This vulnerability is not exploitable on every JetEngine installation. The Custom Content Types module must be explicitly enabled, and at least one CCT must be configured with a public REST GET endpoint. Sites that do not use the CCT feature, or that have not exposed any CCT endpoints publicly, are not vulnerable to this specific attack vector.

Patch Information

Crocoblock fixed CVE-2026-4352 in JetEngine version 3.8.6.2, released before the public disclosure on April 13, 2026. Wordfence lists the remediation as updating to version 3.8.6.2 or any newer patched version.

The changelog for version 3.8.6.2 (confirmed from the vendor's release notes) lists two relevant fixes:

• FIX: Query Builder. CCT query type. Possible SQL injection in some cases. This is the direct fix for CVE-2026-4352 and addresses the _cct_search parameter injection.
• FIX: Query Builder. SQL query type. More strict check for input filter props to avoid potential SQL injections. This is a related hardening fix that tightens input validation on the SQL query type's filter properties.

JetEngine is a commercial, closed-source WordPress plugin distributed through Crocoblock's marketplace rather than a public repository, so no source-level diff is publicly available. The nature of the fix is still well understood from the advisory context. The patch replaces the unsafe sprintf() string interpolation with parameterized queries using $wpdb->prepare(), so user-supplied search values are escaped before they are embedded in the SQL statement. This is the standard WordPress pattern for preventing SQL injection. The $wpdb->prepare() method uses placeholders (%s, %d) that the WordPress database abstraction layer quotes and escapes safely.

Site administrators running any version of JetEngine up to and including 3.8.6.1 should update to at least version 3.8.6.2 immediately. At the time of writing, the latest available release is 3.8.8, which includes additional unrelated improvements.

If change management constraints or compatibility testing requirements rule out immediate patching, administrators can reduce the attack surface through configuration. The exploit requires a public REST GET endpoint, so administrators should temporarily disable the Custom Content Types module entirely. Alternatively, they can reconfigure all Custom Content Types so that no public REST GET endpoint is exposed, which eliminates the attack path until the patch can be safely deployed.

Affected Systems and Versions

• Plugin: JetEngine (by Crocoblock)
• Affected versions: All versions up to and including 3.8.6.1
• Fixed version: 3.8.6.2
• Platform: WordPress
• Vulnerable configuration: The Custom Content Types module must be enabled, and at least one CCT must be configured with a public REST GET endpoint

Vendor Security History

The JetEngine plugin has a notable history of security issues. Wordfence has documented 18 distinct vulnerabilities in it. A run of high-severity flaws discovered in early 2026 is particularly concerning:

Three high-severity vulnerabilities in under two months, two of them separate SQL injection flaws, suggest that organizations using Crocoblock products should run rigorous security monitoring and keep aggressive patching schedules. The repeated SQL injection findings in particular may indicate systemic patterns in how the plugin's codebase handles user input.

References

• NVD: CVE-2026-4352
• Wordfence Threat Intel: JetEngine 3.8.6.1 Unauthenticated SQL Injection
• Wordfence: JetEngine Vulnerability History
• Crocoblock JetEngine Plugin Page
• JetEngine Release Notes
• Crocoblock About Us
• JetEngine Overview (Knowledge Base)