CVE-2025-39477: 
WordPress vulnerability analysis and mitigation

CVE-2025-39477 is a Missing Authorization (Broken Access Control) vulnerability in the InWave Jobs WordPress plugin by Sfwebservice, affecting all versions through 3.5.8. It allows unauthenticated remote attackers to exploit incorrectly configured access control security levels, potentially gaining unauthorized access to sensitive functionality. The vulnerability was reported by Mohamed Ali (@0vulns) on December 26, 2024, and published by Patchstack on January 6, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical), assigned by Patchstack (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to perform adequate authorization checks before executing privileged or sensitive operations. This allows an unauthenticated attacker to invoke functions that should be restricted to higher-privileged users, exploiting incorrectly configured access control security levels. No authentication, user interaction, or special conditions are required for exploitation — the attack is fully remote and low-complexity. No detailed technical write-up or public proof-of-concept code has been published as of the time of this report (Patchstack).

Successful exploitation grants an unauthenticated attacker high impact across all three security dimensions: confidentiality (unauthorized access to sensitive job listing data, user information, or site content), integrity (ability to modify or delete plugin data and records), and availability (potential disruption of plugin or site functionality). Given the WordPress plugin context, attackers could manipulate job postings, access applicant data, or leverage the access control bypass as a foothold for further site compromise. Patchstack notes that vulnerabilities of this severity are commonly used in mass-exploit campaigns targeting thousands of WordPress sites regardless of traffic or popularity (Patchstack).

No public proof-of-concept exploit code has been published, and there is no confirmed evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.041%, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack classifies it as high priority and warns it is the type of vulnerability commonly leveraged in mass WordPress exploit campaigns (Patchstack).

As of the time of publication, no official patch from the plugin developer (Sfwebservice) is available for InWave Jobs. Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts until an official fix is released. Recommended actions include:

• Deactivate or remove the InWave Jobs plugin (versions ≤ 3.5.8) until a patched version is available.
• Apply Patchstack's virtual patch if using their service for immediate mitigation.
• Restrict network access to WordPress admin and plugin endpoints where possible.
• Monitor for an official patch release from Sfwebservice and apply promptly upon availability (Patchstack).

The vulnerability received limited but notable coverage in the WordPress security community. Patchstack, the CNA that assigned and disclosed the CVE, flagged it as high priority due to its critical CVSS score and the mass-exploitation risk profile typical of broken access control issues in WordPress plugins. Brief mentions appeared on social platforms including Bluesky and Mastodon via TheHackerWire, as well as aggregator sites such as CyberHub Blog and CVEFeed. No major vendor statements or in-depth researcher commentary beyond Patchstack's advisory have been identified (Patchstack).