CVE-2026-4352

The JetEngine plugin for WordPress is vulnerable to SQL Injection via the Custom Content Type (CCT) REST API search endpoint in all versions up to, and including, 3.8.6.1. This is due to the `_cct_search` parameter being interpolated directly into a SQL query string via `sprintf()` without sanitization or use of `$wpdb->prepare()`. WordPress REST API's `wp_unslash()` call on `$_GET` strips the `wp_magic_quotes()` protection, allowing single-quote-based injection. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The Custom Content Types module must be enabled with at least one CCT configured with a public REST GET endpoint for exploitation.

• CWE-89

• https://crocoblock.com/plugins/jetengine/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/29a5701f-92f7-4a02-a990-b189a381cff5?source=cve

Published

Apr 14, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4351The Perfmatters plugin for WordPress is vulnerable to arbitr…8.1
• CVE-2026-43510manage.get.gov is the .gov TLD registrar maintained by CISA.…5.9
• CVE-2026-43512DEPRECATED: Authentication Bypass Issues vulnerability in di…9.8
• CVE-2026-43513Improper Handling of Case Sensitivity vulnerability in LockO…7.5
• CVE-2026-43514Observable Timing Discrepancy vulnerability when comparing A…3.7
• CVE-2026-43515Improper Authorization vulnerability when multiple method co…9.1
• CVE-2026-43526OpenClaw before 2026.4.12 contains a server-side request for…9.3
• CVE-2026-43527OpenClaw before 2026.4.14 contains a server-side request for…7.7
• CVE-2026-43528OpenClaw before 2026.4.14 contains a redaction bypass vulner…7.1
• CVE-2026-43529OpenClaw before 2026.4.10 contains a time-of-check-time-of-u…2.5
• CVE-2026-4353The CI HUB Connector plugin for WordPress is vulnerable to S…6.4
• CVE-2026-43530OpenClaw versions 2026.2.23 before 2026.4.12 contain a weake…8.8