CVE-2026-4662

The record

The JetEngine plugin for WordPress is vulnerable to SQL Injection via the `listing_load_more` AJAX action in all versions up to, and including, 3.8.6.1. This is due to the `filtered_query` parameter being excluded from the HMAC signature validation (allowing attacker-controlled input to bypass security checks) combined with the `prepare_where_clause()` method in the SQL Query Builder not sanitizing the `compare` operator before concatenating it into SQL statements. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database, provided the site has a JetEngine Listing Grid with Load More enabled that uses a SQL Query Builder query.

Affected packages

Related vulnerabilities

• CVE-2026-87936 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')… CWE-89
• CVE-2026-87938 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')… CWE-89
• CVE-2026-114664 Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the… CWE-89
• CVE-2026-114577 A vulnerability was found in oretnom23 php-travel-agency-system. CWE-89
• CVE-2026-113406 BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. CWE-89
• CVE-2026-113405 BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. CWE-89
• CVE-2026-107081 SQL injection via identifier injection in the tableName and tableFields POST parameters… CWE-89
• CVE-2026-112150 A security flaw has been discovered in vraj404 Criminal-Management-System up to… CWE-89