JetEngine SQL Injection Vulnerability in WordPress REST API Search Endpoint

A SQL injection vulnerability has been identified in the JetEngine plugin for WordPress, affecting all versions through 3.8.6.1. The issue arises in the Custom Content Type (CCT) REST API search endpoint, where the '_cct_search' parameter is directly inserted into a SQL query using sprintf() without proper sanitization or preparation. This vulnerability allows unauthenticated attackers to manipulate SQL queries and extract sensitive data from the database. Exploitation requires the Custom Content Types module to be active, with at least one CCT having a public REST GET endpoint.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary SQL commands, potentially leading to the extraction of sensitive information from the database.

Remediation

Users are advised to update the JetEngine plugin to version 3.8.6.2 or a later patched version.