# CVE-2026-12360: Crocoblock JetEngine SQL injection in listing_load_more AJAX handler

Source: https://junglewise.ai/threats/cve-2026-12360-crocoblock-jetengine-sql-injection-in-listing-load-more-ajax  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-17. Updated: 2026-06-17  
License: CC BY 4.0 with a link back

CVE-2026-12360 · Severity: high · CVSS 7.5 · Published 2026-06-17

The JetEngine plugin for WordPress, which is used to build dynamic content and listings, contains a security flaw that allows unauthorized individuals to access sensitive database information. By sending a specially crafted request to the website's 'Load More' feature, an attacker can bypass security checks and extract data without needing a login. This could lead to the exposure of private customer information or internal site data, potentially damaging the organization's reputation and data privacy compliance.

Technologies: [Crocoblock JetEngine](https://junglewise.ai/threats/technologies/jetengine). Vendors: [Crocoblock](https://junglewise.ai/threats/vendors/crocoblock).

## Quick answers

**Is CVE-2026-12360 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12360 being exploited in the wild.

**How severe is CVE-2026-12360?** High severity, with a CVSS score of 7.5, published 17 June 2026.

**Which products and versions are affected?** Crocoblock JetEngine up to and including 3.8.10.1.

**Is there a fix for CVE-2026-12360?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-12360 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-12360?** Check whether you run Crocoblock JetEngine at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The JetEngine plugin for WordPress is vulnerable to unauthenticated SQL injection via the 'listing_load_more' AJAX handler. The root cause is a failure to sanitize 'meta_query' row values within the 'filtered_query' parameter before they are merged into SQL statements. While the plugin uses HMAC signatures to protect most query parameters, 'filtered_query' is explicitly excluded from this check to facilitate front-end filtering. An attacker can intercept a legitimate AJAX request from a public Listing Grid page and append malicious SQL syntax to the 'meta_query' array. This enables blind SQL injection (time-based or boolean), allowing for the exfiltration of sensitive data from the WordPress database. The vulnerability affects all versions up to and including 3.8.10.1.

## Affected products

- Crocoblock JetEngine up to and including 3.8.10.1

## Timeline

- 2026-06-17: disclosed
- 2026-06-17: advisory

## References

- [https://crocoblock.com/changelog/?plugin=jet-engine](https://crocoblock.com/changelog/?plugin=jet-engine)
- [https://plugins.trac.wordpress.org/browser/jet-engine/trunk/includes/components/listings/ajax-handlers.php](https://plugins.trac.wordpress.org/browser/jet-engine/trunk/includes/components/listings/ajax-handlers.php)
- [https://plugins.trac.wordpress.org/browser/jet-engine/trunk/includes/components/listings/ajax-handlers.php](https://plugins.trac.wordpress.org/browser/jet-engine/trunk/includes/components/listings/ajax-handlers.php)
- [https://plugins.trac.wordpress.org/browser/jet-engine/trunk/includes/components/listings/ajax-handlers.php](https://plugins.trac.wordpress.org/browser/jet-engine/trunk/includes/components/listings/ajax-handlers.php)
- [https://plugins.trac.wordpress.org/browser/jet-engine/trunk/includes/components/query-builder/queries/traits/meta-query.php](https://plugins.trac.wordpress.org/browser/jet-engine/trunk/includes/components/query-builder/queries/traits/meta-query.php)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/fd839b20-69d1-4cad-80fc-3e7b9940fd30?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/fd839b20-69d1-4cad-80fc-3e7b9940fd30?source=cve)

## Related threats

- [Crocoblock JetEngine stored cross-site scripting](https://junglewise.ai/threats/cve-2026-125785-improper-neutralization-of-input-during-web-page-generation)
- [Crocoblock JetEngine stored cross-site scripting](https://junglewise.ai/threats/cve-2026-123477-improper-neutralization-of-input-during-web-page-generation)
- [Crocoblock JetEngine SQL injection](https://junglewise.ai/threats/cve-2026-39736-improper-neutralization-of-special-elements-used-in-an-sql)
- [Crocoblock JetEngine broken access control](https://junglewise.ai/threats/cve-2026-39735-missing-authorization-vulnerability-in-crocoblock-jetengine-jet)
- [Crocoblock JetEngine SQL injection vulnerability](https://junglewise.ai/threats/cve-2026-115608-improper-neutralization-of-special-elements-used-in-an-sql)