CVE-2026-12360

The JetEngine plugin for WordPress is vulnerable to SQL injection in all versions up to and including 3.8.10.1. The listing_load_more AJAX handler accepts a filtered_query parameter that is intentionally excluded from the HMAC query signature check to support front-end filter integration. However, meta_query row values within filtered_query are not sanitized before being merged into SQL construction. This makes it possible for unauthenticated attackers to perform time-based or boolean blind SQL injection by appending a malicious meta_query value to a Load More AJAX request captured from any public Listing Grid page.

• CWE-89

• https://crocoblock.com/changelog/?plugin=jet-engine
• https://plugins.trac.wordpress.org/browser/jet-engine/trunk/includes/components/listings/ajax-handlers.php#L195
• https://plugins.trac.wordpress.org/browser/jet-engine/trunk/includes/components/listings/ajax-handlers.php#L256
• https://plugins.trac.wordpress.org/browser/jet-engine/trunk/includes/components/listings/ajax-handlers.php#L328
• https://plugins.trac.wordpress.org/browser/jet-engine/trunk/includes/components/query-builder/queries/traits/meta-query.php#L98
• https://www.wordfence.com/threat-intel/vulnerabilities/id/fd839b20-69d1-4cad-80fc-3e7b9940fd30?source=cve

Published

Jun 17, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12349The Premium Addons for KingComposer plugin for WordPress is …5.3
• CVE-2026-1235The WP eCommerce WordPress plugin through 3.15.1 unserialize…6.5
• CVE-2026-12352This vulnerability allows an unauthenticated actor to bypass…5.9
• CVE-2026-12353An unauthenticated attacker could trigger an Out of Memory c…5.3
• CVE-2026-12357Heimdall Data Database Proxy generateFileContent CRLF Inject…7.2
• CVE-2026-1236The Envira Gallery for WordPress plugin for WordPress is vul…6.4
• CVE-2026-1237Vulnerable cross-model authorization in juju. If a charm's c…2.1
• CVE-2026-12372A Server-Side Request Forgery (SSRF) vulnerability exists in…3.7
• CVE-2026-12374Improper certificate validation and a time-of-check time-of-…6.4
• CVE-2026-12375The uncanny-automator-pro WordPress plugin before 7.3.0.6 wa…9.8
• CVE-2026-12376The Academy LMS WordPress plugin through 3.8.2 does not rest…4.3
• CVE-2026-12378The Appointment Booking Calendar Plugin and Scheduling Plugi…8.1