A critical SQL injection vulnerability in the JetEngine plugin allows unauthenticated attackers to extract sensitive database information.

This flaw involves improper neutralization of special elements used in SQL commands (CWE-89) within the SQL Query Builder. The vulnerability is exploitable by unauthenticated attackers who can manipulate the filtered_query parameter and the compare operator to append unauthorized SQL queries.

The ability for an unauthenticated attacker to perform SQL injection poses a severe risk to data confidentiality. Attackers could potentially extract sensitive user data, configuration details, or credentials from the underlying database, leading to unauthorized data exposure and significant reputational damage. Given the CVSS score of 7.5, this high severity flaw warrants immediate attention to prevent full database compromise.

Immediate Action: Update the JetEngine plugin to version 3.8.6.2 or higher immediately to ensure the HMAC signature validation and SQL sanitization are correctly applied.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax or unusual parameters directed at the listing_load_more AJAX endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) with robust SQL injection filtering rules to block malicious payloads targeting the JetEngine query parameters.

Public Exploit Available: No confirmed public exploit exists in the provided data.

This vulnerability represents a significant risk to WordPress installations utilizing the JetEngine plugin. Administrators must verify their plugin version immediately and apply the latest security update provided by Crocoblock to mitigate the potential for unauthorized data extraction. If an immediate update is not feasible, consider disabling the affected Listing Grid functionality until the patch can be applied.