CVE-2026-25340: SQL Injection in Jobmonster WordPress Plugin

The SQL Injection vulnerability in Jobmonster allows an attacker to bypass security measures and directly interact with the underlying database. Because it's a blind SQL injection, the attacker doesn't receive direct output from the database queries, but can infer information through timing or other indirect methods. This enables them to extract sensitive data such as user credentials, job postings, application details, and potentially even database schema information. Successful exploitation could lead to complete compromise of the WordPress site and its associated data, including potential data breaches and defacement.

1. Reserved2026-02-02
2. Published2026-03-25
3. Modified2026-04-28
4. EPSS updated2026-04-02

The primary mitigation for CVE-2026-25340 is to immediately upgrade the Jobmonster plugin to version 4.8.4 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing a Web Application Firewall (WAF) rule to filter potentially malicious SQL injection attempts targeting the vulnerable endpoints. Specifically, look for unusual characters and patterns in user input that are commonly used in SQL injection attacks. Additionally, review and restrict database user permissions to minimize the impact of a successful attack. After upgrading, confirm the fix by attempting a SQL injection payload on the vulnerable endpoint and verifying that it is properly blocked.