Junglewise Threat Intelligence

CVE-2026-12360: Crocoblock JetEngine SQL injection in listing_load_more AJAX handler

CVE-2026-12360 · Severity: high · CVSS 7.5 · Published 2026-06-17

Technologies: Crocoblock JetEngine. Vendors: Crocoblock.

Executive brief

The JetEngine plugin for WordPress, which is used to build dynamic content and listings, contains a security flaw that allows unauthorized individuals to access sensitive database information. By sending a specially crafted request to the website's 'Load More' feature, an attacker can bypass security checks and extract data without needing a login. This could lead to the exposure of private customer information or internal site data, potentially damaging the organization's reputation and data privacy compliance.

Technical details

The JetEngine plugin for WordPress is vulnerable to unauthenticated SQL injection via the 'listing_load_more' AJAX handler. The root cause is a failure to sanitize 'meta_query' row values within the 'filtered_query' parameter before they are merged into SQL statements. While the plugin uses HMAC signatures to protect most query parameters, 'filtered_query' is explicitly excluded from this check to facilitate front-end filtering. An attacker can intercept a legitimate AJAX request from a public Listing Grid page and append malicious SQL syntax to the 'meta_query' array. This enables blind SQL injection (time-based or boolean), allowing for the exfiltration of sensitive data from the WordPress database. The vulnerability affects all versions up to and including 3.8.10.1.

Affected products

  • Crocoblock JetEngine up to and including 3.8.10.1

Timeline

  • 2026-06-17: disclosed
  • 2026-06-17: advisory

References

Related threats