The Crocoblock JetEngine plugin for WordPress contains an unauthenticated SQL injection vulnerability that allows remote attackers to extract sensitive database content.

This flaw is a SQL injection vulnerability within the Custom Content Type REST API search endpoint. It occurs because the _cct_search parameter is improperly sanitized before being used in a SQL query, allowing unauthenticated attackers to execute arbitrary database queries.

Successful exploitation of this vulnerability allows unauthorized access to the underlying WordPress database. Given the CVSS score of 7.5, this high-severity flaw poses a significant risk of data exfiltration, potentially exposing sensitive user information or configuration data, which could lead to further system compromise or regulatory non-compliance.

Immediate Action: Update the JetEngine plugin to the latest version immediately to ensure the input sanitization fix is applied. If an update is not yet available, disable the Custom Content Types module until a patch is deployed.

Proactive Monitoring: Review database access logs and WordPress REST API request logs for anomalous patterns, such as unexpected SQL syntax characters in GET requests directed at the CCT endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block SQL injection patterns, specifically targeting REST API requests containing suspicious characters or SQL keywords.

Public Exploit Available: Unknown

This vulnerability represents a significant risk due to the potential for unauthenticated data exfiltration. Organizations utilizing the JetEngine plugin must verify their current version and apply the vendor-supplied update as soon as it becomes available. Until patching is confirmed, limiting exposure through WAF rules or disabling the vulnerable module is essential to maintain the integrity of the environment.