CVE-2026-49084: WordPress JetEngine plugin < 3.8.9.1 - SQL Injection vulnerability

Synopsis

An unauthenticated SQL injection vulnerability affects the JetEngine WordPress plugin in versions before 3.8.9.1. The flaw is reachable over the network with no authentication required and no user interaction needed, making it trivially accessible to remote attackers. Successful exploitation reads data from the underlying database and can cause limited service disruption; a patched-image rebuild at version 3.8.9.1 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the WordPress installation via HTTP/HTTPS from any internet-connected host.

• AuthenticationNot required

  No account or session token is needed; the SQL injection can be triggered by an anonymous, unauthenticated request.

• Victim interactionNot required

  The attacker sends a crafted request directly to the server; no administrator or user action is required to trigger the vulnerability.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and requires no special conditions, race timing, or environmental setup to succeed.

Blast Radius

• Reads arbitrary rows from the WordPress database, including stored user credentials (hashed passwords), email addresses, and any plugin or application data.
• Reads session tokens or nonces persisted in the database, which can enable follow-on account takeover of existing WordPress users.
• The A:L (Low availability) impact means the database or web process can be degraded or partially disrupted through malformed queries, causing intermittent errors for legitimate users.
• Because the scope token is Changed (S:C), the impact can extend beyond the WordPress application itself to other services or data sharing the same database server.