CVE-2026-12360 JetEngine <= 3.8.10.1 - Unauthenticated SQL Injection via Listing Grid Load More AJAX Endpoint
Unauthenticated attackers can perform blind SQL injection via the Load More AJAX endpoint in JetEngine, allowing unauthorized database access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-12360?
CVE-2026-12360 is a high-severity SQL injection vulnerability in Crocoblock JetEngine, published on 17 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The JetEngine plugin for WordPress is vulnerable to SQL injection in all versions up to and including 3.8.10.1. The listing_load_more AJAX handler accepts a filtered_query parameter that is intentionally excluded from the HMAC query signature check to support front-end filter integration. However, meta_query row values within filtered_query are not sanitized before being merged into SQL construction. This makes it possible for unauthenticated attackers to perform time-based or boolean blind SQL injection by appending a malicious meta_query value to a Load More AJAX request captured from any public Listing Grid page.
Weakness: CWE-89
Which versions are affected by CVE-2026-12360?
How do I fix CVE-2026-12360?
No fix has been published for CVE-2026-12360 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-12360 being exploited?
There is no known exploitation of CVE-2026-12360 in the wild and no public exploit code.
Sources
Also known as GHSA-32hf-5r4g-fq65.