CVE-2026-4352

OVERVIEW CVE-2026-4352 is a SQL injection vulnerability in the JetEngine plugin for WordPress, affecting all versions up to and including 3.8.6.1. The flaw exists in the Custom Content Type (CCT) REST API search endpoint, where the _cct_search parameter is directly interpolated into SQL queries without proper sanitization or use of WordPress database preparation functions. The vulnerability requires the Custom Content Types module to be enabled with at least one CCT configured with a public REST GET endpoint. SEVERITY This vulnerability carries a CVSS 3.1 score of 7.5 (HIGH), with a network-based attack vector requiring no authentication or user interaction. The attack complexity is low, meaning exploitation requires minimal technical sophistication. While the vulnerability enables confidentiality breaches through unauthorized database access and sensitive information extraction, it does not permit data modification or system availability impacts. The high CVSS rating reflects the ease of exploitation and the significant risk of data exposure. EXPLOITATION STATUS There is no current evidence of active exploitation in the wild, as this vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog and is not on the Hot List. The EPSS score of 0.0008 indicates extremely low probability of exploitation within the next 30 days relative to the broader CVE population. However, organizations should prioritize patching given the public nature of the vulnerability details and the relative ease of exploitation by unauthenticated threat actors.