{"id":86234,"date":"2026-01-08T11:19:09","date_gmt":"2026-01-08T11:19:09","guid":{"rendered":""},"modified":"-0001-11-30T00:00:00","modified_gmt":"-0001-11-30T00:00:00","slug":"cve-2025-2010-sql-injection-vulnerability-in-jobwp-plugin-for-wordpress","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-2010-sql-injection-vulnerability-in-jobwp-plugin-for-wordpress\/","title":{"rendered":"CVE-2025-2010: SQL Injection Vulnerability in JobWP Plugin for WordPress<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

This report outlines the details of a severe SQL Injection vulnerability identified in the JobWP – Job Board, Job Listing, Career Page and Recruitment Plugin plugin for WordPress. The vulnerability, marked as CVE-2025-2010, can be exploited by unauthenticated attackers to extract sensitive information from the database. As such, it poses a significant risk to websites using affected versions of this plugin and requires immediate attention to mitigate potential security breaches.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-2010
\nSeverity: High – CVSS 7.5
\nAttack Vector: Network
\nPrivileges Required: None
\nUser Interaction: None
\nImpact: Potential system compromise or data leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

JobWP – Job Board, Job Listing, Career Page and Recruitment Plugin for WordPress | Up to 2.3.9<\/p>\n

How the Exploit Works<\/strong><\/p>\n

The JobWP – Job Board, Job Listing, Career Page and Recruitment Plugin plugin for WordPress is vulnerable to SQL Injection via the ‘jobwp_upload_resume’ parameter. Due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query, unauthenticated attackers can append additional SQL queries into already existing queries. This can be used to extract sensitive information from the database.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

Below is a conceptual example of how the vulnerability might be exploited:<\/p>\n

POST \/wp-content\/plugins\/jobwp-upload-resume HTTP\/1.1\nHost: target.example.com\nContent-Type: application\/json\n{ \"jobwp_upload_resume\": \"'; SELECT * FROM wp_users --\" }<\/code><\/pre>\n
In this example, the attacker uses the ‘jobwp_upload_resume’ parameter to append a new SQL command (`SELECT * FROM wp_users`) to the original query, potentially allowing them to retrieve all user data from the database.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview This report outlines the details of a severe SQL Injection vulnerability identified in the JobWP – Job Board, Job Listing, Career Page and Recruitment Plugin plugin for WordPress. The vulnerability, marked as CVE-2025-2010, can be exploited by unauthenticated attackers to extract sensitive information from the database. As such, it poses a significant risk to […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[],"tags":[],"vendor":[],"product":[],"attack_vector":[],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-86234","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t