CVE-2026-25377: Addon Jobsearch Chat SQLi Vulnerability

CVE-2026-25377 Overview

CVE-2026-25377 is a critical SQL Injection vulnerability affecting the eyecix Addon Jobsearch Chat plugin for WordPress. This vulnerability allows unauthenticated attackers to execute arbitrary SQL commands against the WordPress database, potentially exposing sensitive user data, job application information, and administrative credentials stored within the system.

Critical Impact

This SQL Injection vulnerability enables remote attackers to extract, modify, or delete database contents without authentication, potentially compromising the entire WordPress installation and all associated user data.

Affected Products

• eyecix Addon Jobsearch Chat plugin version 3.0 and earlier
• WordPress installations utilizing the addon-jobsearch-chat plugin

Discovery Timeline

• 2026-03-25 - CVE-2026-25377 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-25377

Vulnerability Analysis

This vulnerability stems from improper neutralization of special elements used in SQL commands within the Addon Jobsearch Chat plugin. The plugin fails to properly sanitize user-supplied input before incorporating it into SQL queries, creating an injection point that attackers can exploit.

SQL Injection vulnerabilities in WordPress plugins are particularly dangerous because they can bypass WordPress's built-in security mechanisms. The affected plugin handles chat functionality for job search features, meaning it processes user input in real-time communication contexts where input validation may have been overlooked.

The network-accessible attack vector combined with no authentication requirement makes this vulnerability exploitable by any remote attacker who can reach the WordPress installation. The scope change indicator suggests that exploitation could affect resources beyond the vulnerable component itself.

Root Cause

The root cause of CVE-2026-25377 is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The vulnerability exists because the plugin directly incorporates user-controlled input into database queries without proper sanitization, parameterization, or use of WordPress's prepared statement functions such as $wpdb->prepare().

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker can craft malicious HTTP requests containing SQL injection payloads targeting vulnerable parameters within the chat functionality. The plugin processes these requests and passes unsanitized data directly to database queries, allowing the attacker to manipulate the SQL statement structure.

Successful exploitation could allow attackers to:

• Extract sensitive data from the WordPress database including user credentials and personal information
• Modify or delete database records
• Potentially escalate to remote code execution depending on database configuration and permissions
• Access job applicant data and private communications stored in the chat system

Detection Methods for CVE-2026-25377

Indicators of Compromise

• Unusual database query patterns in WordPress logs containing SQL syntax characters such as single quotes, UNION statements, or comment sequences
• HTTP requests to chat-related endpoints containing encoded SQL injection payloads
• Unexpected database modifications or data exfiltration attempts
• Error messages in logs revealing database structure information

Detection Strategies

• Monitor web application firewall logs for SQL injection signature matches targeting the addon-jobsearch-chat plugin endpoints
• Implement database activity monitoring to detect anomalous query patterns or unauthorized data access
• Review access logs for requests containing common SQL injection indicators such as ', --, UNION, SELECT, or 1=1
• Deploy WordPress security plugins capable of detecting and blocking SQL injection attempts

Monitoring Recommendations

• Enable detailed logging for all database queries originating from the chat plugin
• Configure alerts for failed SQL queries that may indicate injection probing attempts
• Monitor for bulk data extraction patterns that could indicate successful exploitation
• Implement real-time web application firewall rules specific to SQL injection attack patterns

How to Mitigate CVE-2026-25377

Immediate Actions Required

• Deactivate and remove the Addon Jobsearch Chat plugin immediately if version 3.0 or earlier is installed
• Review WordPress database logs for signs of previous exploitation
• Change all WordPress administrator and database credentials as a precaution
• Conduct a security audit of the WordPress installation to identify any compromise indicators

Patch Information

As of the last update, the vulnerability affects Addon Jobsearch Chat versions through 3.0. Organizations should check the Patchstack SQL Injection Advisory for the latest patch availability and update to a fixed version when available from the vendor.

Workarounds

• Disable the Addon Jobsearch Chat plugin until a patched version is available
• Implement web application firewall rules to block SQL injection payloads targeting chat-related endpoints
• Restrict network access to WordPress administrative functions and the affected plugin endpoints where possible
• Consider implementing database-level query restrictions to limit the potential impact of SQL injection attacks

# WordPress configuration - disable plugin via wp-cli
wp plugin deactivate addon-jobsearch-chat --path=/var/www/html/wordpress

# Verify plugin is deactivated
wp plugin list --status=inactive --path=/var/www/html/wordpress | grep addon-jobsearch-chat