9.8
CVE-2025-1315
- EPSS 0.22%
- Veröffentlicht 07.03.2025 09:15:16
- Zuletzt bearbeitet 13.03.2025 15:00:51
- Quelle security@wordfence.com
- CVE-Watchlists
- Unerledigt
LoginInWave Jobs <= 3.5.1 - Unauthenticated Privilege Escalation via Password Reset
The InWave Jobs plugin for WordPress is vulnerable to privilege escalation via password reset in all versions up to, and including, 3.5.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
Mögliche Gegenmaßnahme
InWave Jobs: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt
InWave Jobs
Version
*-3.5.1
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Sfwebservice ≫ Injob SwPlatformwordpress Version <= 3.5.1
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.22% | 0.441 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| security@wordfence.com | 9.8 | 3.9 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
CWE-288 Authentication Bypass Using an Alternate Path or Channel
The product requires authentication, but the product has an alternate path or channel that does not require authentication.
CWE-306 Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.