External risk intelligence

JetEngine SQL Injection Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-42774

This vulnerability exists in a WordPress plugin used to build dynamic websites and web applications. As a web-facing plugin, it is typically part of the public-facing surface of a website, making it reachable via the internet as part of the standard deployment of such sites.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security vulnerability has been identified in the JetEngine component, which is used in web development. This issue, classified as SQL Injection, could allow unauthorized access to or manipulation of backend data if exploited. The main concern at this time is confirming whether this specific component is in use within our digital assets to assess potential relevance.

A data access flaw exists in a web development tool.
High potential impact requires confirming relevance.
Understand exposure to data.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by sending specially crafted input to a public-facing feature of the JetEngine plugin. This malicious input targets how the plugin processes SQL commands, allowing the attacker to inject their own SQL code. Successful exploitation could lead to unauthorized access to sensitive data or manipulation of the associated database.

Reachable via the internet.
SQL commands process user input.
Allows data access or modification.

Live Threat

Current exploitation, exposure, and threat context

This SQL injection vulnerability in JetEngine could allow an unauthenticated attacker to access or manipulate database information. When supported by the advisory, this could occur if a specially crafted request is sent to an affected system, potentially leading to unauthorized disclosure of sensitive data or disruption of service.

Database information and integrity.
Via a network request.
Unauthorized data access and service disruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Crocobloc JetEngine plugin's SQL injection vulnerability requires immediate attention from teams managing WordPress sites. The first practical step is to identify all instances of JetEngine, assess their exposure and business criticality, and then determine the accountable owner for remediation planning.

Application owners and platform teams.
Verify JetEngine instances and exposure.
Plan remediation or implement mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Crocoblock JetEngine plugin?

JetEngine is a dynamic content plugin for WordPress used to build complex websites and web applications. It provides tools for creating custom post types, taxonomies, and meta fields. By enabling developers to display and manage custom database content through an intuitive interface, it powers the functional data layer of many WordPress sites.

What does SQL Injection mean for CVE-2026-42774?

This vulnerability is classified as CWE-89, or SQL Injection. It occurs when a program fails to properly clean user-provided data before including it in a database query. In this case, the plugin incorrectly processes input, allowing an attacker to inject their own malicious SQL commands into the backend database, potentially tricking the system into revealing or altering sensitive information it should have kept private.

How can an attacker trigger this vulnerability?

An unauthenticated attacker triggers this bug by sending a crafted network request containing malicious input to the affected plugin. This exploit path relies on the plugin interacting with the database based on that input. Importantly, simply having the plugin installed does not trigger the flaw; it requires the specific, improperly handled inputs to be processed by the plugin's internal functions.

Is my website at risk from this CVE?

According to Halo Surface Signal, this vulnerability is highly relevant because JetEngine is a web-facing plugin typically installed on the public-facing surface of a website. Because it is designed to handle dynamic data, it is inherently reachable via the internet, meaning if your site runs an affected version, the vulnerable code is likely accessible to any remote attacker.

What should I do if I use JetEngine?

Your first step is to create an inventory of all websites where JetEngine is active to confirm if they fall within the affected version range. Once identified, evaluate the business criticality of those specific assets. Determine who owns the maintenance of these sites and coordinate with them to plan for updates or necessary security mitigations to protect your database integrity.

References

patchstack.com/database/wordpress/plugin/jet-engine/vulnerability/wo…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.