Plattform
wordpress
Komponente
wp-job-portal
Behoben in
2.3.3
CVE-2025-48274 describes a critical SQL Injection vulnerability discovered in the WP Job Portal plugin. This flaw allows attackers to perform blind SQL injection, potentially leading to unauthorized data extraction and system compromise. The vulnerability affects versions from 0.0.0 up to and including 2.3.2. A patch is available in version 2.3.3.
The SQL Injection vulnerability in WP Job Portal allows an attacker to bypass security measures and directly interact with the database. Due to the 'blind' nature of the injection, attackers must infer data through repeated queries, making exploitation more time-consuming but still highly effective. Successful exploitation could lead to the extraction of sensitive user data, including usernames, passwords, email addresses, and potentially financial information if stored in the database. Lateral movement within the WordPress environment is also possible if the attacker can leverage the injected SQL to gain access to administrative privileges or other sensitive areas of the site. This vulnerability shares similarities with other SQL injection attacks where database contents are exfiltrated or modified.
CVE-2025-48274 was publicly disclosed on 2025-06-17. The vulnerability's severity is classified as CRITICAL with a CVSS score of 9.3. As of this writing, there are no known public proof-of-concept exploits, but the nature of SQL injection makes it likely that one will emerge. It is not currently listed on the CISA KEV catalog, but its criticality warrants close monitoring. Active campaigns targeting WordPress plugins are common, so vigilance is advised.
Websites utilizing the WP Job Portal plugin, particularly those running older, unpatched versions (0.0.0–2.3.2), are at significant risk. Shared hosting environments where multiple websites share the same database are especially vulnerable, as a compromise of one site could potentially expose data from others. Sites with custom integrations or extensions built on top of WP Job Portal are also at increased risk.
• wordpress / composer / npm:
grep -r "wp_query" /var/www/html/wp-content/plugins/wp-job-portal/• generic web:
curl -I https://your-wordpress-site.com/wp-job-portal/ | grep SQL• wordpress / composer / npm:
wp plugin list --status=inactive | grep wp-job-portal• wordpress / composer / npm:
wp plugin auto-update --alldisclosure
Exploit-Status
EPSS
0.05% (17% Perzentil)
CISA SSVC
CVSS-Vektor
The primary mitigation for CVE-2025-48274 is to immediately upgrade the WP Job Portal plugin to version 2.3.3 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing a Web Application Firewall (WAF) with rules specifically designed to detect and block SQL injection attempts targeting the plugin's endpoints. Carefully review and sanitize all user inputs to the plugin to prevent malicious SQL code from being injected. Monitor WordPress access logs for suspicious SQL queries or unusual database activity. While a direct detection signature is difficult to create for blind SQL injection, monitoring for abnormally high database query rates from specific IP addresses can be an indicator.
Actualice el plugin WP Job Portal a la versión 2.3.3 o superior para mitigar la vulnerabilidad de inyección SQL ciega. Asegúrese de realizar una copia de seguridad de su sitio web antes de actualizar. Verifique que la actualización se haya realizado correctamente revisando los registros del sitio web y realizando pruebas funcionales.
Schwachstellenanalysen und kritische Warnungen direkt in deinen Posteingang.
CVE-2025-48274 is a critical SQL Injection vulnerability affecting the WP Job Portal plugin, allowing attackers to potentially extract sensitive data through blind SQL injection.
You are affected if you are using WP Job Portal versions 0.0.0 through 2.3.2. Immediately check your plugin version and upgrade if necessary.
Upgrade the WP Job Portal plugin to version 2.3.3 or later. If immediate upgrade is not possible, implement a WAF and carefully sanitize user inputs.
While no public exploits are currently known, the vulnerability's severity and the nature of SQL injection suggest active exploitation is possible. Continuous monitoring is recommended.
Refer to the WP Job Portal plugin's official website or WordPress plugin repository for the latest security advisory and update information.
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.