Cyber Posture

CVE-2025-5397

Critical

Published: 31 October 2025

Published
31 October 2025
Modified
15 April 2026
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0046 64.2th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-5397 is an authentication bypass vulnerability in the Noo JobMonster theme for WordPress, affecting all versions up to and including 4.8.1. The flaw arises in the check_login() function, which fails to properly verify a user's identity before successfully authenticating them. Sites are only impacted if social login is enabled.

Unauthenticated attackers can exploit this vulnerability remotely with low complexity, requiring no privileges or user interaction. Successful exploitation allows bypassing standard authentication to gain access to administrative user accounts, potentially leading to full compromise. The CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) underscores its critical severity, mapped to CWE-288 (Authentication Bypass Using an Alternate Path or Channel).

Advisories and references include a Wordfence threat intelligence report at https://www.wordfence.com/threat-intel/vulnerabilities/id/6fa4aa8d-d7f1-4e91-bb2c-c9f80a4bb216?source=cve and the theme's product page on ThemeForest at https://themeforest.net/item/jobmonster-job-board-wordpress-theme/10965446.

Details

CWE(s)
CWE-288

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

The vulnerability is an authentication bypass in a public-facing WordPress theme, enabling unauthenticated remote exploitation for administrative access.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References