CVE-2026-42774: Crocoblock JetEngine SQL Injection
CVE-2026-42774 is an SQL injection flaw (CWE-89) in Crocoblock JetEngine, with the record listing affected versions from n/a through 3.8.8.1. Patchstack, the CNA, assigns a CVSS 3.1 base score of 9.3 (critical), but the record contains no structured affected or fixed version data. The CVE is not in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.
Overview
CVE-2026-42774 is a SQL injection vulnerability classified as CWE-89 in Crocoblock JetEngine, a plugin family whose Patchstack reference is filed under WordPress plugins. The CVE record was published on 2026-05-25 with Patchstack (audit@patchstack.com) as the CNA and its source status is marked as Deferred.
Impact
- Patchstack scores the issue at 9.3 under CVSS 3.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, and the record labels it critical.
- Reading the vector, the flaw is reachable over the network with low complexity and no privileges or user interaction, with high confidence impact and a changed scope. This reading is our inference from the vector, not a statement from the sources.
- SQL injection can allow an attacker to read or alter data handled by the database, so the practical impact depends on how the plugin is deployed.
Affected products and versions
- Product: JetEngine by Crocoblock.
- Affected range stated in the record: from n/a through 3.8.8.1. The lower bound is not specified.
- The structured affected and fixes lists in the record are empty, so no fixed version is confirmed.
Exploitation status
- The record shows kev.listed as false, so this CVE is not in the CISA KEV catalog.
- No confirmed exploitation in the wild appears in the sources consulted.
- The EPSS probability is 0.004 (about 0.4%), at the 32nd percentile, with the date given in the record as 2026-10-13.
Remediation and mitigation
- The record does not identify a fixed version. Check the Patchstack advisory and the vendor's release notes for a JetEngine release newer than 3.8.8.1, and update only when a fix is confirmed.
- Until a fix is confirmed, inventory every site running JetEngine and limit exposure of affected features to trusted users.
- Apply the principle of least privilege to the database account used by the application, which reduces the damage a successful injection can cause.
- Consider filtering at the web application firewall layer as temporary compensating control, and validate it in a test environment first.
Detection guidance
- Review web server and application logs for unusual requests to JetEngine functionality and for unexpected parameter values.
- Watch for database errors that reference SQL syntax in application responses or logs, which can indicate probing.
- Monitor for unexpected changes in database content or unusual bulk data access from the web application account.
Limitations of the available information
- The lower bound of the affected range is recorded only as n/a.
- No fixed version, patch, or structured affected product data is present in the record.
- The record does not include NVD analysis details, and the only vendor-side reference is the Patchstack page.
- Exploitation status is limited to what the KEV listing and the consulted sources show.
Frequently asked questions
Is CVE-2026-42774 being actively exploited?
The record shows it is not listed in the CISA KEV catalog, and no confirmed exploitation in the wild appears in the sources consulted.
Which JetEngine versions are affected?
The record states the affected range as from n/a through 3.8.8.1. The lower bound is not specified, so check the Patchstack advisory for details.
Is there a fixed version available?
The record does not list a fixed version. Check the Patchstack advisory and vendor release notes for a release newer than 3.8.8.1 and update only when a fix is confirmed.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.