CVE-2025-1315

CRITICAL EXPLOITED

Sfwebservice Injob < 3.5.1 - Missing Authentication

Title source: rule
STIX 2.1

Exploitation Summary

CVE-2025-1315 has been observed exploited in the wild (reported by VulnCheck KEV).

Description

The InWave Jobs plugin for WordPress is vulnerable to privilege escalation via password reset in all versions up to, and including, 3.5.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.

References (2)

Core 2

Scores

CVSS v3 9.8
EPSS 0.0046
EPSS Percentile 36.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

VulnCheck KEV 2025-03-07
CWE
CWE-306 CWE-288
Status published
Products (2)
sfwebservice/injob < 3.5.1
sfwebservice/InWave Jobs < 3.5.1
Published Mar 07, 2025
Tracked Since Feb 18, 2026