CVE-2026-12360
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedThe JetEngine plugin for WordPress is vulnerable to SQL injection in all versions up to and including 3.8.10.1. The listing_load_more AJAX handler accepts a filtered_query parameter that is intentionally excluded from the HMAC query signature check to support front-end filter integration. However, meta_query row values within filtered_query are not sanitized before being merged into SQL construction. This makes it possible for unauthenticated attackers to perform time-based or boolean blind SQL injection by appending a malicious meta_query value to a Load More AJAX request captured from any public Listing Grid page.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceThe JetEngine plugin for WordPress contains an unauthenticated SQL injection vulnerability in the listing_load_more AJAX handler. The filtered_query parameter is excluded from HMAC signature verification to support front-end filter integration, but meta_query row values within it are not sanitized before being used in SQL construction, allowing attackers to inject malicious SQL via the meta_query values.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Confirm JetEngine plugin is installedIn WordPress admin, go to Plugins > Installed Plugins and locate JetEngine, or check the plugin files for version information in the main plugin file headerAffected if JetEngine plugin is present but version is below 3.8.10.2
-
Verify the listing_load_more AJAX endpoint is activeCheck if the WordPress AJAX endpoint /wp-admin/admin-ajax.php?action=listing_load_more is accessible and responds to requests. This can be confirmed by examining the JetEngine plugin code for the registered AJAX handler or by testing the endpoint responseAffected if The listing_load_more AJAX handler is registered and publicly accessible (no authentication required)
-
Inspect filtered_query parameter handlingReview the JetEngine plugin code that processes the filtered_query parameter in the listing_load_more AJAX handler. Look for how meta_query values are handled in SQL construction and whether sanitization occurs before being used in database queriesAffected if The code uses meta_query values from filtered_query directly in SQL without proper sanitization or prepared statements
-
Check for suspicious SQL in logsReview WordPress debug logs, server access logs, or database slow query logs for unusual SQL patterns or injection attempts targeting the listing_load_more endpoint, particularly meta_query parameter patternsAffected if Evidence of malicious SQL injection attempts or unusual SQL queries containing meta_query manipulation is found in logs
A user is affected if JetEngine plugin versions below 3.8.10.2 are installed and the listing_load_more AJAX endpoint with the vulnerable filtered_query parameter handling is active and accessible.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scopedUpgrade to JetEngine version 3.8.10.2 or later. Alternatively, if immediate upgrade is not possible, disable the Listing Grid functionality or implement server-side filtering to block the listing_load_more AJAX endpoint until the patch can be applied.
JetEngine version 3.8.11 or later
- 1. Navigate to Plugins > Installed Plugins in the WordPress admin dashboard
- 2. Locate the JetEngine plugin in the list
- 3. Check the current installed version number
- 4. If the installed version is 3.8.10.1 or lower, navigate to Plugins > Add New > Upload Plugin or check for an update
- 5. Update JetEngine to version 3.8.11 or later which contains the security fix
- 6. Verify the update was successful by confirming the new version number
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation4.0 h
- Implementation4.0 h
- Testing4.0 h
- Review / QA2.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $3,968.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2026-12360 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2026-12360 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data