CVE Intelligence
Analysis AI-assisted

CVE-2026-56068: JetEngine WordPress Plugin Unauthenticated SQL Injection

CVE-2026-56068 is an unauthenticated SQL injection (CWE-89) in the JetEngine plugin for WordPress, affecting versions up to and including 3.8.10.2. The CNA Patchstack assigned a CVSS 3.1 base score of 9.3 (Critical), but the sources consulted do not list a fixed version. No confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes an unauthenticated SQL injection in the JetEngine plugin for WordPress, affecting versions up to and including 3.8.10.2 and classified as CWE-89. The CNA is audit@patchstack.com, and the main reference is the Patchstack database entry.

Impact

  • The CNA-provided CVSS 3.1 vector indicates a network attack vector, low complexity, no privileges and no user interaction required, and a changed scope.
  • The vector rates confidentiality impact as high, integrity impact as none and availability impact as low.
  • An SQL injection reachable without authentication can expose database content that the plugin handles. This is an inference from the vulnerability class and is not detailed in the record.

Affected products and versions

  • The description places the issue in JetEngine versions up to and including 3.8.10.2.
  • The record's affected product list is empty, so exact affected builds beyond that statement are not confirmed.
  • No fixed version is listed in the record. The absence of a fixed version does not prove that no fix exists.

Exploitation status

  • The CISA KEV catalog does not list this CVE in the record, so no active exploitation is claimed here.
  • No confirmed exploitation appears in the sources consulted.
  • The EPSS probability is 0.004 with a percentile of 0.32394, dated 2026-10-13. These values estimate exploitation likelihood and do not confirm exploitation.

Remediation and mitigation

  • Identify all sites running JetEngine and confirm the installed version.
  • Check the vendor or Patchstack entry for a fixed release and update to it as soon as one is confirmed.
  • If no fix is available yet, consider temporarily disabling the plugin or restricting access to affected functionality, and review your hosting or web application firewall policies.
  • Keep WordPress core, themes and plugins updated and remove unused components.

Detection guidance

  • Review web server and application logs for unusual database error messages, malformed parameters and repeated requests to JetEngine endpoints.
  • Monitor for unexpected changes to database content or new administrative accounts.
  • Use the CVSS and CWE information to prioritize review of internet-facing sites first.

Limitations of the available information

  • The record does not list the affected endpoint, parameter or technical preconditions.
  • The record contains no fixed version, vendor patch reference or vendor advisory beyond the Patchstack entry.
  • The source status is Deferred and the record does not explain why.
  • The record does not include an NVD-assigned score, so the only score available is the CNA's CVSS 3.1 score.

Frequently asked questions

Which versions of JetEngine are affected by CVE-2026-56068?

The description states that the issue affects JetEngine versions up to and including 3.8.10.2. The record does not list further affected builds.

Does the record show a fixed version?

No. The record does not list a fixed version, so users should check the vendor or Patchstack entry for an update.

Is this vulnerability known to be actively exploited?

The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.