CVE-2025-5397

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-5397", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-05-30T16:34:42.983Z", "datePublished": "2025-10-31T06:42:54.832Z", "dateUpdated": "2026-04-08T16:59:58.036Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:59:58.036Z"}, "affected": [{"vendor": "Unknown", "product": "Noo JobMonster", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.8.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Noo JobMonster theme for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.8.1. This is due to the check_login() function not properly verifying a user's identity prior to successfully authenticating them This makes it possible for unauthenticated attackers to bypass standard authentication and access administrative user accounts. Please note social login needs to be enabled in order for a site to be impacted by this vulnerability."}], "title": "Jobmonster - Job Board WordPress Theme <= 4.8.1 - Authentication Bypass", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6fa4aa8d-d7f1-4e91-bb2c-c9f80a4bb216?source=cve"}, {"url": "https://themeforest.net/item/jobmonster-job-board-wordpress-theme/10965446"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel", "cweId": "CWE-288", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "credits": [{"lang": "en", "type": "finder", "value": "Th\u00e1i An"}], "timeline": [{"time": "2025-10-30T18:40:35.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-31T14:28:51.783763Z", "id": "CVE-2025-5397", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-31T14:40:20.080Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-5397", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-10-31T14:28:51.783763Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-31T14:40:14.587Z"}}], "cna": {"title": "Jobmonster - Job Board WordPress Theme <= 4.8.1 - Authentication Bypass", "credits": [{"lang": "en", "type": "finder", "value": "Th\u00e1i An"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "Unknown", "product": "Noo JobMonster", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "4.8.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-30T18:40:35.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6fa4aa8d-d7f1-4e91-bb2c-c9f80a4bb216?source=cve"}, {"url": "https://themeforest.net/item/jobmonster-job-board-wordpress-theme/10965446"}], "descriptions": [{"lang": "en", "value": "The Noo JobMonster theme for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.8.1. This is due to the check_login() function not properly verifying a user's identity prior to successfully authenticating them This makes it possible for unauthenticated attackers to bypass standard authentication and access administrative user accounts. Please note social login needs to be enabled in order for a site to be impacted by this vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-288", "description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-10-31T06:42:54.832Z"}}}, "cveMetadata": {"cveId": "CVE-2025-5397", "state": "PUBLISHED", "dateUpdated": "2025-10-31T14:40:20.080Z", "dateReserved": "2025-05-30T16:34:42.983Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-31T06:42:54.832Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Noo JobMonster", "vendor": "Unknown", "versions": [{"lessThanOrEqual": "4.8.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Noo JobMonster theme for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.8.1. This is due to the check_login() function not properly verifying a user's identity prior to successfully authenticating them This makes it possible for unauthenticated attackers to bypass standard authentication and access administrative user accounts. Please note social login needs to be enabled in order for a site to be impacted by this vulnerability."}, {"lang": "es", "value": "El tema Noo JobMonster para WordPress es vulnerable a la omisi\u00f3n de autenticaci\u00f3n en todas las versiones hasta la 4.8.1, inclusive. Esto se debe a que la funci\u00f3n check_login() no verifica correctamente la identidad de un usuario antes de autenticarlos con \u00e9xito. Esto hace posible que atacantes no autenticados omitan la autenticaci\u00f3n est\u00e1ndar y accedan a cuentas de usuario administrativas. Tenga en cuenta que el inicio de sesi\u00f3n social debe estar habilitado para que un sitio se vea afectado por esta vulnerabilidad."}], "id": "CVE-2025-5397", "lastModified": "2026-10-07T21:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-5397", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-10-31T14:28:51.783763Z", "version": "2.0.3"}}]}, "published": "2025-10-31T07:15:37.427", "references": [{"source": "security@wordfence.com", "url": "https://themeforest.net/item/jobmonster-job-board-wordpress-theme/10965446"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6fa4aa8d-d7f1-4e91-bb2c-c9f80a4bb216?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-288"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T18:43:35.585877+00:00", "value": {"mitigation_remediation": ["Upgrade the Noo JobMonster theme to the latest available version (4.8.2 or newer) where the authentication bypass has been fixed.", "If a theme update cannot be applied immediately, disable the social login feature either in the theme settings or via a security plugin to eliminate the vulnerable code path.", "Verify that no other plugins or custom code modify the check_login() logic, and apply all pending security updates to WordPress core and other plugins."], "summary": {"action": "Apply Patch", "impact": "Authentication Bypass"}, "threat_synthesis": {"affected_systems": "All versions of the Noo JobMonster WordPress theme up to and including 4.8.1 are affected. The flaw specifically impacts installations where the social login feature is enabled, as this activates the vulnerable check_login() code path.", "description_and_impact": "The Noo JobMonster theme for WordPress is affected by an authentication bypass flaw that allows unauthenticated attackers to acquire administrative privileges, provided that social login functionality is enabled on the site. The vulnerability originates from the check_login() function failing to properly verify a user's identity before granting access, exposing all administrative user accounts. Although this flaw does not directly lead to code execution or data exfiltration, it enables attackers to fully control the WordPress instance, potentially defacing content, publishing malicious posts, or altering site configuration.", "risk_and_exploitability": "The vulnerability carries a CVSS score of 9.8, indicating critical severity, yet the EPSS score is less than 1%, implying a low probability of exploitation at this time. The flaw is not listed in CISA KEV. Attackers can exploit it by accessing any page that triggers the check_login() function while social login is active, without needing any credentials. Compromise leads to full administrative control of the WordPress site."}}}}, "created": "2025-11-03T10:45:02.535775+00:00", "updated": "2026-04-21T18:45:06.085277+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}