CVE-2023-36525CWE-89

WordPress WPJobBoard plugin <= 5.9.0 - Unauth. Blind SQL Injection (SQLi) vulnerability

High · published December 24, 2025

CVSS v3.1
8.6
EPSS
0%
Percentile
40.6
In the wild
Unconfirmed
What it is

⚡ A sneaky SQL injection flaw lurks in WPJobBoard, and it’s ready to play tricks up to version 5.9.0! Think of this like a restaurant where the chef takes orders without verifying the special requests. If the kitchen trusts these orders blindly, a rogue customer could substitute ingredients that lead to a disastrous dish! An attacker could exploit this blind SQL injection vulnerability to extract sensitive information from the database, potentially leading to unauthorized data exposure. This could spell absolute chaos for your users and the integrity of your application!

Put simply

Think of this like a restaurant where the chef takes orders without verifying the special requests. If the kitchen trusts these orders blindly, a rogue customer could substitute ingredients that lead to a disastrous dish! This vulnerability allows for improper neutralization of special elements in SQL commands, enabling attackers to manipulate database queries without needing to see the results directly. Essentially, the application fails to properly sanitize user inputs, allowing SQL commands to be injected.

What to do

An attacker could exploit this blind SQL injection vulnerability to extract sensitive information from the database, potentially leading to unauthorized data exposure. This could spell absolute chaos for your users and the integrity of your application! To tighten your defenses, immediately update WPJobBoard to version 5.9.1 or later. Also, ensure that any user inputs are properly sanitized and utilize prepared statements to prevent similar vulnerabilities in the future. You've got this! With these steps, you'll have your security fortress back in shape in no time! 🛡️

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00482 · 40.6th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-12-24T12:49Z
EPSS history
Timeline
  • 24 DEC 12:49Z
    WordPress WPJobBoard plugin <= 5.9.0 - Unauth. Blind SQL Injection (SQLi) vulnerability
    cvelistv5