CVE-2025-39477
Published: 06 January 2026
Summary
CVE-2025-39477 is a critical-severity Missing Authorization (CWE-862) vulnerability. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 21.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-24 (Access Control Decisions) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2025-39477 is a missing authorization vulnerability in the Sfwebservice component of the InWave Jobs (iwjob) WordPress plugin. This flaw, tied to CWE-862 (Missing Authorization), allows exploitation of incorrectly configured access control security levels and affects all versions of InWave Jobs from n/a through 3.5.8. Published on 2026-01-06, it carries a CVSS v3.1 base score of 9.8, marking it as critical due to its network accessibility, low attack complexity, and lack of prerequisites.
Unauthenticated attackers can exploit this vulnerability remotely over the network (AV:N/AC:L/PR:N/UI:N/S:U) with no user interaction required. Successful exploitation enables high-impact outcomes on confidentiality, integrity, and availability (C:H/I:H/A:H), potentially granting unauthorized access to sensitive functions and leading to data breaches, modification, or service disruption on affected WordPress sites.
The Patchstack advisory provides further details on this broken access control vulnerability in the InWave Jobs plugin version 3.5.8, including mitigation guidance: https://patchstack.com/database/Wordpress/Plugin/iwjob/vulnerability/wordpress-inwave-jobs-plugin-3-5-8-broken-access-control-vulnerability?_s_id=cve.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-1007
Vulnerability details
Missing Authorization vulnerability in Sfwebservice InWave Jobs iwjob allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects InWave Jobs: from n/a through <= 3.5.8.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authorization (CWE-862) in a publicly accessible WordPress plugin component directly enables remote, unauthenticated exploitation of a public-facing web application over the network with no prerequisites.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates enforcement of approved authorizations for access to system resources, countering the missing authorization in the Sfwebservice component.
Requires explicit authorization decisions for system resources prior to access, addressing exploitation of incorrectly configured access control security levels.
Applies least privilege to limit the scope of unauthorized access enabled by the vulnerability, reducing potential impact on confidentiality, integrity, and availability.