WordPress JetSearch plugin <= 3.5.10 - SQL Injection vulnerability

The SQL Injection vulnerability in JetSearch allows an attacker to bypass security measures and execute arbitrary SQL queries against the underlying database. Because it's a Blind SQL Injection, the attacker doesn't receive direct output from the queries, but can infer information based on the database's response (e.g., timing differences). This could lead to the extraction of user credentials, configuration details, or other sensitive information stored within the database. Successful exploitation could compromise the entire WordPress site and potentially lead to data breaches or complete system takeover. While no direct precedent exists for this specific plugin, Blind SQL Injection vulnerabilities are frequently exploited, and the potential impact is significant.

WordPress websites utilizing Crocoblock JetSearch, particularly those with sensitive data stored in the database, are at risk. Shared hosting environments where multiple websites share the same database are especially vulnerable, as a compromise of one site could potentially expose data from others.

• wordpress / composer / npm:

grep -r "SELECT .* FROM" /var/www/html/wp-content/plugins/jet-search/

• generic web:

curl -I 'https://your-wordpress-site.com/jet-search/?q='; # Check for unusual headers or error messages

• wordpress / composer / npm:

wp plugin list --status=active | grep jet-search

• wordpress / composer / npm:

wp plugin update jet-search

1. 2025-10-22Disclosure

   disclosure

1. Gereserveerd2025-06-11
2. Gepubliceerd2025-10-22
3. Gewijzigd2026-04-28
4. EPSS bijgewerkt2026-03-23

The primary mitigation for CVE-2025-49931 is to immediately upgrade Crocoblock JetSearch to version 3.5.11 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing a Web Application Firewall (WAF) rule to block suspicious SQL queries targeting the JetSearch endpoints. Specifically, look for patterns indicative of SQL injection attempts, such as unusual character sequences or attempts to inject SQL commands. Additionally, review and restrict database user permissions to limit the potential damage from a successful attack. After upgrading, confirm the fix by attempting a SQL injection payload against the vulnerable endpoint and verifying that it is blocked or returns an error.