CVE-2026-49076: WordPress JetEngine plugin <= 3.8.9.1 - SQL Injection vulnerability

Synopsis

An unauthenticated SQL injection vulnerability affects the JetEngine WordPress plugin at version 3.8.9.1 and earlier. The flaw is reachable over the network with no login required, and no victim interaction is needed to trigger it. Successful exploitation gives an attacker direct read access to the underlying database and causes minor disruption to service availability. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the WordPress installation via HTTP or HTTPS.

• AuthenticationNot required

  No account or session credential of any kind is needed; the injection is reachable by any anonymous HTTP request.

• Victim interactionNot required

  The attacker does not need to trick or wait for any user to take an action; the request can be sent directly and autonomously.

• Attack complexityDetail

  Exploit reliability is high and no special preconditions such as race conditions or specific memory layout are required.

Blast Radius

• Reads arbitrary rows from the WordPress database, including stored user credentials (hashed passwords), email addresses, session tokens, and any customer or order data managed by JetEngine.
• The CVSS scope token is Changed, meaning the attacker can reach data outside the WordPress application boundary, such as other databases or tables on the same MySQL instance.
• Causes limited disruption to service availability, consistent with the Low availability impact score, such as degraded query performance or intermittent errors under sustained attack.