PT-2026-1494 · Sfwebservice · Inwave Jobs

Published 2026-01-06 · Updated 2026-01-06 · CVE-2025-39477

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions InWave Jobs versions through 3.5.8

Description The Sfwebservice InWave Jobs software contains a missing authorization issue, allowing exploitation of incorrectly configured access control security levels. An unauthenticated attacker can execute privileged actions remotely.

Recommendations Update InWave Jobs to version 3.5.9.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-39477

Affected Products

Inwave Jobs

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-39477 · Security Note
• https://patchstack.com/database/wordpress/plugin/iwjob/vulnerability/wordpress-inwave-jobs-plugin-3-5-8-broken-access-control-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/2008589637564903603 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/iwjob/vulnerability/wordpress-inwave-jobs-plugin-3-5-8-broken-access-control-vulnerability?_s_id=cve · Note
• https://twitter.com/CveFindCom/status/2008594292642611536 · Twitter Post
• https://twitter.com/0dayPublishing/status/2008587094550073564 · Twitter Post
• https://twitter.com/TheHackerWire/status/2008607300789886998 · Twitter Post