CVE-2025-2010

Deeper analysis

The JobWP – Job Board, Job Listing, Career Page and Recruitment Plugin for WordPress is affected by an SQL injection vulnerability in all versions through 2.3.9. The flaw resides in the jobwp_upload_resume parameter, where insufficient escaping of user input and the absence of prepared statements allow an attacker to modify existing database queries.

Unauthenticated remote attackers can exploit the issue over the network to append arbitrary SQL statements, enabling extraction of sensitive information from the WordPress database. The vulnerability carries a CVSS 3.1 score of 7.5 with a network attack vector, low complexity, and no required authentication or user interaction.

The referenced Wordfence advisory and WordPress plugin changeset indicate that the issue is resolved in version 2.4.0 by updating the affected job_application.php file to properly sanitize the parameter and employ prepared queries; site administrators should apply the update promptly.

EPSS for the CVE rose materially from a low baseline to a peak of 0.2283 on 2026-02-13 before receding, indicating that exploitation interest increased well after public disclosure.