CVE-2025-32146: Joomsky Js Job Manager Path Traversal Flaw

CVE-2025-32146 Overview

CVE-2025-32146 is a PHP Local File Inclusion (LFI) vulnerability in the JoomSky JS Job Manager WordPress plugin (js-jobs). The flaw stems from improper control of the filename used in PHP include or require statements [CWE-98]. Authenticated attackers with low privileges can include arbitrary local files on the server, leading to source code disclosure, configuration exposure, and potential remote code execution. The vulnerability affects all versions of JS Job Manager from n/a through <= 2.0.2.

Critical Impact
Authenticated attackers can include arbitrary PHP files on the host, exposing sensitive data and potentially achieving remote code execution on WordPress installations running JS Job Manager <= 2.0.2.

Affected Products

JoomSky JS Job Manager WordPress plugin (js-jobs)
All versions from n/a through 2.0.2
WordPress sites with the plugin enabled and accessible to authenticated users

Discovery Timeline

2025-04-04 - CVE-2025-32146 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32146

Vulnerability Analysis

The vulnerability is classified under [CWE-98] — Improper Control of Filename for Include/Require Statement in PHP Program. JS Job Manager accepts user-supplied input and passes it into a PHP include or require call without sufficient validation or sanitization. Although the original advisory categorizes the root weakness as PHP Remote File Inclusion, exploitation in this plugin is limited to Local File Inclusion (LFI) of files already present on the WordPress host.

A successful LFI lets an attacker read sensitive files such as wp-config.php, exposing database credentials, authentication keys, and salts. When combined with techniques like log poisoning, session file inclusion, or upload of attacker-controlled content, the LFI can be escalated to remote code execution.

Exploitation requires authenticated access with low privileges (PR:L), and no user interaction is needed. The attack is launched over the network against the WordPress endpoint exposing the vulnerable plugin parameter.

Root Cause

The root cause is the use of unsanitized request input as a filename argument to a PHP file inclusion function. The plugin fails to enforce an allowlist of permitted include targets and does not normalize path traversal sequences such as ../ before resolving the path passed to include/require.

Attack Vector

An authenticated attacker submits a crafted HTTP request to a JS Job Manager endpoint that controls the include target. By supplying a relative or absolute path, the attacker forces the plugin to load arbitrary local PHP files. See the Patchstack advisory for JS Job Manager for technical details on the vulnerable parameter and endpoint.

Detection Methods for CVE-2025-32146

Indicators of Compromise

HTTP requests to JS Job Manager endpoints containing path traversal sequences such as ../, ..%2f, or absolute paths like /etc/passwd and wp-config.php.
Web server access logs showing authenticated users supplying file paths in plugin parameters that normally accept identifiers or view names.
PHP error logs referencing include() or require() failures pointing to unexpected file locations outside the plugin directory.
Outbound or local file reads of wp-config.php, .htaccess, or session files immediately following requests to js-jobs endpoints.

Detection Strategies

Inspect WordPress request logs for parameters whose values resemble filesystem paths instead of expected job listing identifiers.
Correlate authenticated session activity with file system access patterns indicative of LFI enumeration.
Deploy WAF rules targeting common LFI payloads against URIs containing /wp-content/plugins/js-jobs/.

Monitoring Recommendations

Enable verbose PHP error logging and forward logs to a centralized SIEM for analysis.
Monitor file integrity of WordPress core files and the js-jobs plugin directory for unauthorized modifications.
Alert on any read access to wp-config.php from web-facing PHP workers.

How to Mitigate CVE-2025-32146

Immediate Actions Required

Identify all WordPress installations running JS Job Manager <= 2.0.2 and prioritize them for remediation.
Restrict access to JS Job Manager endpoints to trusted authenticated users until a patched version is deployed.
Rotate WordPress secrets (AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, NONCE_KEY) and database credentials if exploitation is suspected.

Patch Information

No fixed version is referenced in the available advisory. Administrators should consult the Patchstack advisory for JS Job Manager and the vendor for an updated release addressing CVE-2025-32146. Apply the vendor patch as soon as it becomes available.

Workarounds

Disable or uninstall the JS Job Manager plugin until a fixed release is published.
Deploy a Web Application Firewall (WAF) rule that blocks requests containing path traversal sequences or absolute filesystem paths in js-jobs parameters.
Harden PHP configuration by setting open_basedir to restrict file access to the WordPress document root, and disable allow_url_include.
Enforce least-privilege access so that low-privileged WordPress accounts cannot reach the vulnerable plugin endpoints.

bash

# Example php.ini hardening to limit LFI impact
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"

# Example nginx rule to block obvious traversal payloads against js-jobs
location ~* /wp-content/plugins/js-jobs/ {
    if ($args ~* "(\.\./|\.\.%2f|/etc/passwd|wp-config\.php)") {
        return 403;
    }
}