CVE-2025-39477CWE-862broken-access-control

CVE-2025-39477

Critical · published January 6, 2026

CVSS v3.1
9.8
EPSS
0%
Percentile
27.0
In the wild
Unconfirmed
What it is

🚨 A sneaky oversight in access control could let anyone waltz right in! 🔥 Think of it as a restaurant where anyone can walk into the kitchen without showing a reservation — chefs might find their secret recipes being shared without permission! An attacker could exploit this vulnerability to gain unauthorized access to sensitive data and operations, potentially wreaking havoc and making critical changes without a trace. This is absolutely devastating for any organization relying on secure access controls!

Put simply

Think of it as a restaurant where anyone can walk into the kitchen without showing a reservation — chefs might find their secret recipes being shared without permission! This vulnerability in the InWave Jobs service is due to missing authorization checks, allowing users to access and manipulate resources they shouldn't be able to reach. The flaw affects versions up to 3.5.8.

What to do

An attacker could exploit this vulnerability to gain unauthorized access to sensitive data and operations, potentially wreaking havoc and making critical changes without a trace. This is absolutely devastating for any organization relying on secure access controls! To address this, immediately update to the latest version of InWave Jobs and audit your access control configurations to ensure correct settings. Implement stricter authorization checks to bolster security. You're on the right track to securing your setup! Follow these steps and you'll be a security hero in no time. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00347 · 27.0th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-01-06T22:15Z
References (1)
EPSS history
Timeline
  • 06 JAN 16:54Z
    WordPress InWave Jobs Plugin <= 3.5.8 - Broken Access Control vulnerability
    cvelistv5