Platform
wordpress
Component
wp-job-portal
Fixed in
2.3.3
CVE-2025-48274 describes a critical SQL Injection vulnerability discovered in the WP Job Portal plugin. This flaw allows attackers to perform blind SQL injection, potentially leading to unauthorized data extraction and system compromise. The vulnerability affects versions from 0.0.0 up to and including 2.3.2. A patch is available in version 2.3.3.
The SQL Injection vulnerability in WP Job Portal allows an attacker to bypass security measures and directly interact with the database. Due to the 'blind' nature of the injection, attackers must infer data through repeated queries, making exploitation more time-consuming but still highly effective. Successful exploitation could lead to the extraction of sensitive user data, including usernames, passwords, email addresses, and potentially financial information if stored in the database. Lateral movement within the WordPress environment is also possible if the attacker can leverage the injected SQL to gain access to administrative privileges or other sensitive areas of the site. This vulnerability shares similarities with other SQL injection attacks where database contents are exfiltrated or modified.
CVE-2025-48274 was publicly disclosed on 2025-06-17. The vulnerability's severity is classified as CRITICAL with a CVSS score of 9.3. As of this writing, there are no known public proof-of-concept exploits, but the nature of SQL injection makes it likely that one will emerge. It is not currently listed on the CISA KEV catalog, but its criticality warrants close monitoring. Active campaigns targeting WordPress plugins are common, so vigilance is advised.
Exploit Status
EPSS
0.05% (17% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2025-48274 is to immediately upgrade the WP Job Portal plugin to version 2.3.3 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing a Web Application Firewall (WAF) with rules specifically designed to detect and block SQL injection attempts targeting the plugin's endpoints. Carefully review and sanitize all user inputs to the plugin to prevent malicious SQL code from being injected. Monitor WordPress access logs for suspicious SQL queries or unusual database activity. While a direct detection signature is difficult to create for blind SQL injection, monitoring for abnormally high database query rates from specific IP addresses can be an indicator.
Update the WP Job Portal plugin to version 2.3.3 or higher to mitigate the blind SQL injection vulnerability. Ensure you back up your website before updating. Verify that the update was successful by reviewing website logs and performing functional tests.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-48274 is a critical SQL Injection vulnerability affecting the WP Job Portal plugin, allowing attackers to potentially extract sensitive data through blind SQL injection.
You are affected if you are using WP Job Portal versions 0.0.0 through 2.3.2. Immediately check your plugin version and upgrade if necessary.
Upgrade the WP Job Portal plugin to version 2.3.3 or later. If immediate upgrade is not possible, implement a WAF and carefully sanitize user inputs.
While no public exploits are currently known, the vulnerability's severity and the nature of SQL injection suggest active exploitation is possible. Continuous monitoring is recommended.
Refer to the WP Job Portal plugin's official website or WordPress plugin repository for the latest security advisory and update information.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.