PT-2025-10066 · WordPress · Inwave Jobs

Tonn · Published 2025-03-07 · Updated 2025-03-08 · CVE-2025-1315

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions InWave Jobs plugin for WordPress versions up to and including 3.5.1

Description The issue allows for privilege escalation via password reset due to improper validation of a user's identity before updating their password. This enables unauthenticated attackers to change arbitrary users' passwords, including those of administrators, and gain access to their accounts.

Recommendations For InWave Jobs plugin for WordPress versions up to and including 3.5.1, update to a version higher than 3.5.1 to resolve the issue. As a temporary workaround, consider restricting access to the password reset functionality until a patch is available.

Fix

LPE

Missing Authentication

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-306

CWE-288

Related Identifiers

CVE-2025-1315

Affected Products

Inwave Jobs

References · 11

• https://osv.dev/vulnerability/CVE-2025-1315 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-1315 · Security Note
• https://twitter.com/vulns_space/status/1897953136960033190 · Twitter Post
• https://twitter.com/cybercronai/status/1898026679693357458 · Twitter Post
• https://twitter.com/CveFindCom/status/1897927947115217104 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/e49c7b2a-5241-4762-b7c9-c33b1ac4a668?source=cve · Note
• https://twitter.com/CVEnew/status/1898246392830640314 · Twitter Post
• https://t.me/cvedetector/19810 · Telegram Post
• https://themeforest.net/item/injob-job-board-wordpress-theme/20322987 · Note
• https://t.me/latest_high_impact_cve/1931 · Telegram Post
• https://t.me/cvetracker/18656 · Telegram Post