CVE-2026-22340: WPJobster SQL Injection Vulnerability

CVE-2026-22340 Overview

CVE-2026-22340 is an unauthenticated SQL injection vulnerability affecting the WPJobster WordPress theme in versions up to and including 6.3.5. The flaw is classified under CWE-89, Improper Neutralization of Special Elements used in an SQL Command. Attackers can exploit the vulnerability remotely over the network without authentication or user interaction. The issue carries a CVSS 3.1 base score of 9.3 with a scope-changed impact, indicating that successful exploitation affects resources beyond the vulnerable component.

Critical Impact
Remote, unauthenticated attackers can inject arbitrary SQL into backend queries, exposing sensitive data stored in the WordPress database and degrading site availability.

Affected Products

WPJobster WordPress theme versions <= 6.3.5
WordPress sites running the WPJobster job marketplace theme
Any deployment exposing WPJobster endpoints to the public internet

Discovery Timeline

2026-06-17 - CVE-2026-22340 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-22340

Vulnerability Analysis

The vulnerability resides in the WPJobster theme code path that constructs SQL queries from user-controlled input without proper sanitization or parameterization. Because the vulnerable endpoint is reachable without authentication, attackers do not need a valid WordPress account to trigger the flaw. The scope-changed classification indicates that exploitation can impact data outside the WPJobster theme boundary, including the broader WordPress database and any plugin tables sharing the same database user. EPSS data published on 2026-06-18 lists an exploit probability of 0.372% at the 28.9 percentile, reflecting that public exploitation activity has not been observed at the time of publication.

Root Cause

The root cause is improper neutralization of special elements in SQL statements [CWE-89]. WPJobster passes attacker-supplied parameters directly into query builders without using prepared statements or the WordPress $wpdb->prepare() API. This allows union-based, boolean-based, or time-based injection payloads to alter the structure of executed queries.

Attack Vector

An attacker sends a crafted HTTP request to a vulnerable WPJobster endpoint, embedding SQL metacharacters in a parameter that flows into a database query. No credentials, tokens, or user interaction are required. Successful injection can enumerate database schema, extract wp_users rows including password hashes, or invoke heavy queries that exhaust database resources.

For technical details, see the Patchstack WPJobster SQL Injection Vulnerability advisory. No verified proof-of-concept code is publicly available at the time of writing.

Detection Methods for CVE-2026-22340

Indicators of Compromise

HTTP requests to WPJobster endpoints containing SQL metacharacters such as UNION SELECT, SLEEP(, OR 1=1, or encoded variants like %27%20OR%201%3D1
Unexpected database errors logged by WordPress or MySQL referencing WPJobster query paths
Anomalous outbound traffic from the web server following requests to WPJobster routes
New or modified administrator accounts in the wp_users table without corresponding admin activity

Detection Strategies

Inspect web server access logs for requests targeting WPJobster AJAX or REST endpoints with suspicious query string content
Enable MySQL general query logging temporarily to identify malformed or injection-style queries originating from the WordPress process
Deploy a web application firewall ruleset that flags SQLi signatures on theme-specific endpoints

Monitoring Recommendations

Forward WordPress, web server, and database logs to a centralized analytics platform for correlation
Alert on spikes in 500-class responses or query execution time anomalies tied to WPJobster URLs
Track changes to privileged WordPress tables including wp_users, wp_usermeta, and wp_options

How to Mitigate CVE-2026-22340

Immediate Actions Required

Identify all WordPress sites running the WPJobster theme and confirm installed versions against 6.3.5
Restrict access to WPJobster endpoints via WAF rules or IP allowlisting until a patched version is installed
Rotate WordPress administrator credentials and database secrets if exploitation is suspected
Review the Patchstack advisory for vendor-supplied remediation guidance

Patch Information

Upgrade WPJobster to a version newer than 6.3.5 once the vendor releases a fix. Consult the Patchstack advisory referenced above for the authoritative fixed version and changelog. Apply the update in a staging environment before promoting to production.

Workarounds

Deploy WAF signatures that block SQL injection payloads targeting WPJobster routes
Limit database user privileges granted to WordPress to the minimum required, removing FILE and administrative grants
Disable or remove the WPJobster theme if it is not actively in use until a patched release is verified

bash

# Example WAF rule blocking common SQLi tokens on WPJobster paths
SecRule REQUEST_URI "@contains /wpjobster" \
  "chain,deny,status:403,id:1026223401,msg:'WPJobster SQLi attempt - CVE-2026-22340'"
  SecRule ARGS "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\s*\(|or\s+1=1|information_schema)" "t:urlDecodeUni"