CVE Intelligence
Analysis AI-assisted

CVE-2026-56067: JetSmartFilters WordPress Plugin Unauthenticated SQL Injection

CVE-2026-56067 describes an unauthenticated SQL injection flaw in JetSmartFilters versions up to and including 3.8.3. The CNA audit@patchstack.com assigned a CVSS 3.1 base score of 9.3 (critical), and the record maps the issue to CWE-89. The record includes no fixed version or structured affected-version list, and it is not listed in CISA KEV.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-56067 is an unauthenticated SQL injection vulnerability (CWE-89) in JetSmartFilters, a WordPress plugin. According to the record, it affects versions up to and including 3.8.3. The record was published on 2026-06-26 and its source status is Deferred. The only reference listed is the Patchstack database entry.

Impact

SQL injection can allow an attacker to influence database queries made by the application. The CNA scored the issue 9.3 (critical) under CVSS 3.1, with network attack vector, low complexity, no privileges required and no user interaction. The vector indicates high confidentiality impact, no integrity impact, low availability impact and a changed scope. These scores come from the CNA only; the record contains no independent scoring.

Affected products and versions

  • Product: JetSmartFilters (WordPress plugin)
  • Stated affected range: versions <= 3.8.3
  • Fixed version: not provided in the record

The record has no structured list of affected or fixed versions. Confirm the exact affected range and any fixed release with the vendor and the Patchstack entry.

Exploitation status

The record shows this CVE is not listed in the CISA KEV catalog. No confirmed exploitation in the wild appears in the sources consulted. The EPSS estimate in the record (probability 0.00454, percentile 0.37693, dated 2026-10-13) reflects a predicted likelihood of exploitation, not observed activity.

Remediation and mitigation

  • Inventory every site running JetSmartFilters and record the installed version.
  • Check the vendor and the Patchstack entry for a release newer than 3.8.3 and apply it as soon as it is verified.
  • If no fixed release is available, consider temporarily deactivating the plugin or restricting access to the functionality it exposes.
  • Use web application firewall rules only as a compensating control while the plugin is updated, not as a replacement for the fix.
  • Review other WordPress plugins on the same sites for similar exposure.

Detection guidance

  • Review web server and application logs for unusual parameter values or abnormal database error messages on requests handled by JetSmartFilters.
  • Monitor for unexpected changes to site content, user accounts or database records.
  • Keep current backups and verify that they can be restored.

Limitations of the available information

The record does not provide a structured affected-version range, a fixed version, vendor-supplied technical details about the vulnerable parameter or code path, or any exploitation telemetry. These points are unknown and should be confirmed with the vendor and Patchstack before drawing conclusions about exposure.

Frequently asked questions

Which JetSmartFilters versions are affected by CVE-2026-56067?

The record states versions up to and including 3.8.3. It does not provide a structured affected-version list, so confirm the range with the vendor and the Patchstack entry.

Is CVE-2026-56067 being actively exploited?

The record does not list it in CISA KEV, and no confirmed exploitation in the wild appears in the sources consulted. The EPSS value is a predicted likelihood, not evidence of attacks.

What should site owners do now?

Identify installations, check for a fixed release newer than 3.8.3, and apply it when verified. If no fix exists, consider deactivating the plugin or restricting access while monitoring logs.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.