Cyber Posture

CVE-2023-36525

High

Published: 24 December 2025

Published
24 December 2025
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
EPSS Score 0.0014 34.4th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPJobBoard allows Blind SQL Injection.This issue affects WPJobBoard: from n/a through 5.9.0.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly prevents blind SQL injection by requiring validation and neutralization of special elements in inputs to SQL commands within the WPJobBoard plugin.

SI-2 Flaw Remediation good match
prevent

Mandates timely identification, reporting, and patching of the specific SQL injection flaw affecting WPJobBoard versions through 5.9.0.

RA-5 Vulnerability Monitoring and Scanning partial match
detect

Vulnerability scanning detects SQL injection vulnerabilities like CVE-2023-36525 in the WPJobBoard plugin for subsequent remediation.

Security SummaryAI

CVE-2023-36525 is an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that enables Blind SQL Injection in the WPJobBoard WordPress plugin. This issue affects WPJobBoard versions from n/a through 5.9.0 and is associated with CWE-89.

With a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L), the vulnerability allows unauthenticated remote attackers to exploit it over the network with low attack complexity and no user interaction required. Successful exploitation can result in low confidentiality impact through limited data exposure, high integrity impact via data modification, and low availability impact.

The Patchstack vulnerability database advisory (https://vdp.patchstack.com/database/wordpress/plugin/wpjobboard/vulnerability/wordpress-wpjobboard-plugin-5-9-0-unauth-blind-sql-injection-sqli-vulnerability?_s_id=cve) documents this unauthenticated blind SQL injection vulnerability in WPJobBoard plugin version 5.9.0.

Details

CWE(s)
CWE-89

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
attack.mitre.org →
T1565.001 Stored Data Manipulation Impact
Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data.
attack.mitre.org →
Why these techniques?

Unauthenticated blind SQL injection in public-facing WordPress plugin enables T1190 (exploit public-facing application), facilitates T1213.006 (data from databases via arbitrary SQL queries), and T1565.001 (stored data manipulation per high integrity impact).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References