Overview
This report outlines the details of a severe SQL Injection vulnerability identified in the JobWP – Job Board, Job Listing, Career Page and Recruitment Plugin plugin for WordPress. The vulnerability, marked as CVE-2025-2010, can be exploited by unauthenticated attackers to extract sensitive information from the database. As such, it poses a significant risk to websites using affected versions of this plugin and requires immediate attention to mitigate potential security breaches.
Vulnerability Summary
CVE ID: CVE-2025-2010
Severity: High – CVSS 7.5
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: Potential system compromise or data leakage
Affected Products
Product | Affected Versions
JobWP – Job Board, Job Listing, Career Page and Recruitment Plugin for WordPress | Up to 2.3.9
How the Exploit Works
The JobWP – Job Board, Job Listing, Career Page and Recruitment Plugin plugin for WordPress is vulnerable to SQL Injection via the ‘jobwp_upload_resume’ parameter. Due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query, unauthenticated attackers can append additional SQL queries into already existing queries. This can be used to extract sensitive information from the database.
Conceptual Example Code
Below is a conceptual example of how the vulnerability might be exploited:
POST /wp-content/plugins/jobwp-upload-resume HTTP/1.1
Host: target.example.com
Content-Type: application/json
{ "jobwp_upload_resume": "'; SELECT * FROM wp_users --" }In this example, the attacker uses the ‘jobwp_upload_resume’ parameter to append a new SQL command (`SELECT * FROM wp_users`) to the original query, potentially allowing them to retrieve all user data from the database.
