Cyber Posture

CVE-2025-1315

Critical

Published: 07 March 2025

Published
07 March 2025
Modified
13 March 2025
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0014 33.2th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-1315 is a privilege escalation vulnerability in the InWave Jobs plugin for WordPress, affecting all versions up to and including 3.5.1. The issue stems from the plugin failing to properly validate a user's identity before allowing a password update, enabling unauthorized password changes. It has been assigned a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-288 (Authentication Bypass Using an Alternate Path or Channel) and CWE-306 (Missing Authentication for Critical Function).

Unauthenticated attackers can exploit this vulnerability remotely over the network with low complexity and no user interaction required. By targeting the password reset functionality, they can change the passwords of arbitrary users, including administrators, thereby gaining full unauthorized access to those accounts and potentially complete control over the affected WordPress site.

Advisories from Wordfence provide detailed threat intelligence on the vulnerability, including its ID e49c7b2a-5241-4762-b7c9-c33b1ac4a668. The plugin's page on ThemeForest offers additional context on the InWave Jobs component. No specific patch information is detailed in the available references, so site owners should review these sources for updates and consider disabling the plugin until remediation is confirmed.

Details

CWE(s)
CWE-288CWE-306

Affected Products

sfwebservice
injob
≤ 3.5.1

MITRE ATT&CK Enterprise Techniques

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1098 Account Manipulation Persistence
Adversaries may manipulate accounts to maintain and/or elevate access to victim systems.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Vulnerability in public-facing WordPress plugin allows unauthenticated remote password changes on arbitrary accounts (including admins), directly enabling exploitation of public-facing apps (T1190), privilege escalation (T1068), and account manipulation via unauthorized password modification (T1098).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References