The JetEngine plugin for WordPress suffers from an SQL Injection vulnerability (CWE-89) in its Custom Content Type REST API search endpoint. The vulnerability is due to the _cct_search parameter being directly interpolated into a SQL query string using sprintf() without proper sanitization or use of $wpdb->prepare(). The WordPress REST API's wp_unslash() removes wp_magic_quotes() protections, enabling single-quote-based injection. This allows unauthenticated attackers to append additional SQL queries to extract sensitive data from the database. Exploitation requires the Custom Content Types module to be enabled with at least one CCT configured with a public REST GET endpoint.

An unauthenticated attacker can exploit this vulnerability to perform SQL Injection attacks, potentially extracting sensitive information from the WordPress database. The vulnerability does not affect integrity or availability but poses a confidentiality risk. The CVSS 3.1 base score is 7.5 (High), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling the Custom Content Types module or restricting access to the affected REST API endpoints to trusted users only. Monitor vendor channels for updates and apply patches promptly once released.