CVE-2026-54187: WordPress JetEngine plugin <= 3.8.10.1 - SQL Injection vulnerability

Synopsis

An unauthenticated SQL injection vulnerability affects the JetEngine WordPress plugin at version 3.8.10.1 and earlier. The flaw is reachable over the network and requires no login or user interaction, derived from a CVSS 9.3 vector with network attack surface and no privilege requirement. Successful exploitation allows an attacker to read sensitive data from the underlying database and cause limited service disruption. No upstream fix has been published yet; HarborGuard tracks the advisory and will make a patched-image rebuild available the moment a fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the WordPress service over the network; no local or physical access is required.

• AuthenticationNot required

  No account or session credential of any privilege level is needed to trigger the injection.

• Victim interactionNot required

  The attack is fully server-side; no user needs to click a link, visit a page, or take any other action.

• Attack complexityDetail

  The exploit is reliable and condition-free, requiring no race-condition timing, specific memory layout, or environmental precondition.

Blast Radius

• An attacker reads arbitrary rows from the WordPress database, including stored user credentials, session tokens, and any customer or form data held in plugin tables.
• Because scope is Changed in the CVSS vector, data from database tables outside the plugin's own scope, such as wp_users and other core tables, is also reachable.
• The availability impact is Low, meaning the attacker can cause intermittent query errors or minor slowdowns, though full service shutdown is not within the established impact range.