CVE-2026-49079: WordPress JetSearch plugin <= 3.5.17 - SQL Injection vulnerability

Synopsis

An unauthenticated SQL injection vulnerability affects the WordPress JetSearch plugin at version 3.5.17 and earlier. The flaw is reachable over the network with no authentication required, making it exploitable by any remote party that can send HTTP requests to a WordPress site running the plugin. Successful exploitation gives an attacker read access to the underlying database contents and causes minor service disruption. No fix version has been published; HarborGuard tracks the advisory and will make a patched rebuild available as soon as an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to send HTTP requests to the target WordPress site over the network; no local or physical access is needed.

• AuthenticationNot required

  No account or credentials of any kind are needed; the vulnerable endpoint is fully accessible to unauthenticated users.

• Victim interactionNot required

  The attacker sends crafted requests directly to the server; no user action or social engineering is involved.

• Attack complexityDetail

  Exploitation is reliable and condition-free, requiring no race conditions, special memory layout, or environmental setup beyond network access to the target.

Blast Radius

• Reads arbitrary database contents, including WordPress user records, password hashes, stored session tokens, and any customer or application data held in the database.
• Reads plugin and site configuration data that may expose credentials or API keys stored in the database, enabling further compromise of connected services.
• Causes minor disruption to the affected service through resource consumption incurred by injected queries.