CVE-2026-4352: 
WordPress vulnerability analysis and mitigation

CVE-2026-4352 is an unauthenticated SQL Injection vulnerability in the JetEngine plugin for WordPress, affecting all versions up to and including 3.8.6.1. The flaw resides in the Custom Content Type (CCT) REST API search endpoint, where the _cct_search parameter is interpolated directly into a SQL query without proper sanitization. It was published on April 14, 2026, and assigned a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Wordfence).

The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The _cct_search GET parameter is passed directly into a SQL query string via PHP's sprintf() function without sanitization or use of WordPress's $wpdb->prepare() method. Critically, the WordPress REST API's wp_unslash() call on $_GET strips the wp_magic_quotes() protection that would otherwise escape single quotes, enabling classic single-quote-based SQL injection. Exploitation requires the Custom Content Types module to be enabled with at least one CCT configured with a publicly accessible REST GET endpoint (GitHub Advisory, Wordfence).

Successful exploitation allows unauthenticated remote attackers to append additional SQL queries to existing database queries, enabling extraction of sensitive information from the WordPress database. This includes user credentials (hashed passwords, email addresses), personal data, plugin configuration data, and any other content stored in the database. The attack requires no authentication or user interaction, making it broadly exploitable against any affected WordPress installation with the CCT module active and publicly exposed (GitHub Advisory, Wordfence).

As of the time of disclosure, there is no confirmed public proof-of-concept exploit and no evidence of active in-the-wild exploitation (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.064% (0.000640), indicating a low near-term probability of exploitation (Wordfence). However, the unauthenticated nature and network-accessible attack vector make it an attractive target if exploitation details become public.

1. Reconnaissance: Identify WordPress sites running JetEngine ≤ 3.8.6.1 using tools like WPScan, Shodan, or Google dorks targeting JetEngine-specific indicators. Confirm the Custom Content Types module is enabled and that at least one CCT has a public REST GET endpoint.
2. Identify the vulnerable endpoint: Locate the CCT REST API search endpoint, typically accessible at a path such as /wp-json/<cct-namespace>/search or similar, depending on the CCT configuration.
3. Craft the injection payload: Construct a GET request with a malicious _cct_search parameter containing a single-quote-based SQL injection payload (e.g., _cct_search=test' UNION SELECT user_login,user_pass,3 FROM wp_users-- -). The wp_unslash() processing by the REST API removes magic quote escaping, allowing the single quote to reach the SQL query.
4. Send the request: Issue the crafted HTTP GET request to the vulnerable endpoint without any authentication headers.
5. Extract data: Parse the JSON response for injected query results, iterating over database tables to extract user credentials, emails, and other sensitive data (GitHub Advisory, Wordfence).

• Network: Unusual or repeated GET requests to JetEngine CCT REST API endpoints (e.g., /wp-json/*/search) containing SQL metacharacters such as single quotes ('), UNION, SELECT, --, or OR 1=1 in the _cct_search query parameter; anomalous outbound data volumes from the web server.
• Logs: WordPress or web server access logs showing GET requests to CCT REST API search endpoints with URL-encoded SQL injection strings (e.g., %27, %20UNION%20SELECT); repeated requests from a single IP or user-agent to the same endpoint with varying payloads.
• File System: No direct file system artifacts expected for a read-only SQL injection, but monitor for subsequent web shell uploads or file modifications if an attacker escalates access using extracted credentials.
• Application: Unexpected database query errors or slow query log entries referencing _cct_search-related queries; WordPress debug logs showing SQL errors from JetEngine's CCT search handler.

Update the JetEngine plugin to a version newer than 3.8.6.1 as soon as a patched release is available from Crocoblock (Crocoblock). As an interim workaround, disable the Custom Content Types module within JetEngine if it is not actively required, or restrict public access to the CCT REST API endpoint via firewall rules or a Web Application Firewall (WAF). Deploy WAF rules to detect and block SQL injection patterns in REST API query parameters. Conduct a database audit to check for unauthorized data access that may have occurred prior to patching (Wordfence, GitHub Advisory).

Wordfence disclosed and reported the vulnerability, publishing it in their threat intelligence database and including it in their weekly WordPress vulnerability report for April 13–19, 2026 (Wordfence Weekly Report). The vulnerability received coverage from automated security aggregators and community feeds including Mastodon and Bluesky CVE tracking accounts shortly after disclosure. No significant vendor statement from Crocoblock or notable independent researcher commentary has been publicly identified beyond the initial advisory.