CVE-2026-56067: WordPress JetSmartFilters plugin <= 3.8.3 - SQL Injection vulnerability

Synopsis

This is an unauthenticated SQL injection vulnerability in the JetSmartFilters WordPress plugin, versions 3.8.3 and earlier, developed by Crocoblock (Jetimpex Inc.). The flaw is reachable over the network with no authentication required and no user interaction needed, matching a CVSS 9.3 Critical rating. Successful exploitation gives an attacker direct read access to the underlying database contents and causes minor service disruption. No upstream fix has been published yet; HarborGuard tracks the advisory and will make a patched rebuild available as soon as one is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, meaning an attacker can send crafted HTTP requests to the WordPress site from any internet-accessible location without needing prior access to the host.

• AuthenticationNot required

  No account or session token of any kind is needed; the injection point is reachable by any anonymous HTTP client.

• Victim interactionNot required

  The attack is fully server-side and requires no action from any user or administrator of the target site.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental prerequisites beyond a reachable target.

Blast Radius

• An attacker reads arbitrary rows from the WordPress database, including password hashes, user email addresses, session tokens, and any other data stored by installed plugins.
• Database confidentiality is fully compromised (CVSS C:H), exposing every record the database user can access, which on many WordPress deployments includes the entire wp_ table set.
• Availability is partially degraded (CVSS A:L); malformed or resource-intensive SQL queries can slow or momentarily disrupt database responsiveness for legitimate site traffic.
• Because the CVSS scope is Changed, impact is not limited to the plugin itself and can extend to other components sharing the same database instance, such as WooCommerce or membership systems running on the same WordPress install.