Cyber Resilience

CVE-2023-36525

High

Published: 24 December 2025

Published
24 December 2025
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
EPSS Score 0.0033 24.2th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-36525 is a high-severity SQL Injection (CWE-89) vulnerability in Patchstack (inferred from references). Its CVSS base score is 8.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2023-36525 is an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that enables Blind SQL Injection in the WPJobBoard WordPress plugin. This issue affects WPJobBoard versions from n/a through 5.9.0 and is associated with CWE-89.

With a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L), the vulnerability allows unauthenticated remote attackers to exploit it over the network with low attack complexity and no user interaction required. Successful exploitation can result in low confidentiality impact through limited data exposure, high integrity impact via data modification, and low availability impact.

The Patchstack vulnerability database advisory (https://vdp.patchstack.com/database/wordpress/plugin/wpjobboard/vulnerability/wordpress-wpjobboard-plugin-5-9-0-unauth-blind-sql-injection-sqli-vulnerability?_s_id=cve) documents this unauthenticated blind SQL injection vulnerability in WPJobBoard plugin version 5.9.0.

EU & UK References

Vulnerability details

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPJobBoard allows Blind SQL Injection.This issue affects WPJobBoard: from n/a through 5.9.0.

CWE(s)
CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
attack.mitre.org →
T1565.001 Stored Data Manipulation Impact
Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data.
attack.mitre.org →
Why these techniques?

Unauthenticated blind SQL injection in public-facing WordPress plugin enables T1190 (exploit public-facing application), facilitates T1213.006 (data from databases via arbitrary SQL queries), and T1565.001 (stored data manipulation per high integrity impact).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-25746Shared CWE-89
CVE-2026-33504Shared CWE-89
CVE-2019-25444Shared CWE-89
CVE-2025-26614Shared CWE-89
CVE-2026-30881Shared CWE-89
CVE-2026-30534Shared CWE-89
CVE-2026-40836Shared CWE-89
CVE-2025-13379Shared CWE-89
CVE-2024-12016Shared CWE-89
CVE-2026-37347Shared CWE-89

Affected Assets

Patchstack
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly prevents blind SQL injection by requiring validation and neutralization of special elements in inputs to SQL commands within the WPJobBoard plugin.

SI-2 Flaw Remediation good match
prevent

Mandates timely identification, reporting, and patching of the specific SQL injection flaw affecting WPJobBoard versions through 5.9.0.

RA-5 Vulnerability Monitoring and Scanning partial match
detect

Vulnerability scanning detects SQL injection vulnerabilities like CVE-2023-36525 in the WPJobBoard plugin for subsequent remediation.

References