SQL Injection Vulnerability in JetEngine Plugin for WordPress

CVE-2026-4662

What is CVE-2026-4662?

The JetEngine plugin for WordPress contains a vulnerability that allows SQL injection through the listing_load_more AJAX action. This issue arises from the failure to validate the filtered_query parameter against HMAC signatures, which permits attackers to insert malicious SQL queries into existing database queries. The SQL Query Builder's prepare_where_clause() method contributes to this security flaw by not adequately sanitizing the compare operator. Attackers can exploit this vulnerability without authentication, potentially leading to unauthorized access to sensitive information stored in the database, particularly when using a JetEngine Listing Grid with Load More functionality.

References