CVE-2025-1315: Sfwebservice Injob Privilege Escalation

CVE-2025-1315 Overview

CVE-2025-1315 is a privilege escalation vulnerability in the InWave Jobs plugin for WordPress. The flaw affects all versions of the sfwebservice/injob plugin up to and including 3.5.1. The plugin fails to validate a user's identity before updating their password. Unauthenticated attackers can reset arbitrary user passwords, including those of administrators, and take over the targeted accounts.

The vulnerability maps to [CWE-288] Authentication Bypass Using an Alternate Path or Channel and [CWE-306] Missing Authentication for Critical Function. Successful exploitation grants full administrative access to the affected WordPress site.

Critical Impact

Unauthenticated attackers can reset administrator passwords remotely over the network, leading to full WordPress site takeover without any user interaction.

Affected Products

• InWave Jobs (InJob) WordPress plugin/theme by sfwebservice
• All versions <= 3.5.1
• WordPress sites distributing the InJob job board theme bundle

Discovery Timeline

• 2025-03-07 - CVE-2025-1315 published to NVD
• 2025-03-13 - Last updated in NVD database

Technical Details for CVE-2025-1315

Vulnerability Analysis

The InWave Jobs plugin exposes a password reset workflow that updates a target user's password without validating the requester's identity. The handler does not require the user to be authenticated, does not verify ownership of a valid reset token, and does not bind the reset request to the account being modified. Attackers can submit a crafted request specifying any user_id or user_login, including administrator accounts, and replace the stored password hash.

The weakness combines two CWE classes. [CWE-306] applies because the password update endpoint is reachable without authentication. [CWE-288] applies because the reset path bypasses the standard WordPress nonce-protected and email-confirmed reset flow. Once the password is overwritten, the attacker logs in through /wp-login.php with the new credentials.

Root Cause

The root cause is missing authentication and missing identity verification on the password update function provided by the plugin. The endpoint trusts client-supplied parameters identifying the account to modify and does not require proof of possession of a reset token issued to the legitimate user's email address.

Attack Vector

Exploitation is performed remotely over HTTP/HTTPS against the WordPress site hosting the vulnerable plugin. The attacker sends a request to the plugin's password reset handler with parameters identifying a privileged account and a chosen password value. No authentication, session, or user interaction is required. After the password is overwritten, the attacker authenticates as the targeted administrator and pivots to plugin installation, file upload, or database access. No verified public proof-of-concept code is available; refer to the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-1315

Indicators of Compromise

• POST requests to InWave Jobs plugin AJAX or REST endpoints containing password reset parameters originating from unauthenticated sessions.
• Unexpected administrator logins from unfamiliar IP addresses following a password change event in WordPress.
• New WordPress administrator accounts, modified user roles, or newly installed plugins shortly after a suspicious password reset request.
• Modifications to wp_users.user_pass for privileged accounts without a corresponding password reset email in mail logs.

Detection Strategies

• Inspect web server access logs for requests targeting plugin handlers under /wp-admin/admin-ajax.php or plugin-specific REST routes referencing password reset actions.
• Correlate WordPress audit log entries for user_password_reset or profile_update events against authentication logs to identify resets without matching login activity.
• Alert on administrator authentication immediately following an anonymous password reset request to the same account.

Monitoring Recommendations

• Enable a WordPress activity logging plugin to capture password change events, role changes, and plugin installations.
• Forward WordPress and web server logs to a centralized SIEM for correlation across authentication, account modification, and file change events.
• Monitor outbound connections from the WordPress host for indicators of post-compromise webshell or backdoor activity.

How to Mitigate CVE-2025-1315

Immediate Actions Required

• Deactivate the InWave Jobs plugin on all WordPress sites running version 3.5.1 or earlier until a patched release is confirmed.
• Force a password reset for all administrator and editor accounts on affected sites and rotate any reused credentials.
• Audit the WordPress user table for unauthorized accounts, role escalations, and recently changed passwords.
• Review installed plugins, themes, and wp-content/uploads for unauthorized files indicating post-exploitation activity.

Patch Information

At the time of NVD publication, all versions up to and including 3.5.1 are listed as vulnerable. Site administrators should consult the ThemeForest InJob Theme Overview for vendor updates and apply the fixed version once released by sfwebservice. The Wordfence Vulnerability Report tracks the patched version status.

Workarounds

• Disable or remove the InWave Jobs plugin until a vendor patch is installed and verified.
• Deploy a web application firewall rule blocking unauthenticated requests to the plugin's password reset endpoints.
• Restrict access to /wp-admin/ and /wp-login.php by IP allowlist or place the site behind an authenticating reverse proxy during remediation.
• Enforce multi-factor authentication for all administrator accounts to limit account takeover impact if a password is reset.

# Configuration example: temporarily disable the vulnerable plugin via WP-CLI
wp plugin deactivate injob --allow-root
wp plugin list --status=active --format=table

# Force password reset for all administrators after remediation
wp user list --role=administrator --field=user_login | \
  xargs -I {} wp user reset-password {} --skip-email