The InWave Jobs plugin for WordPress allows an attacker who is not logged in to reset the passwords of any user account, including administrators. The flaw lies in the lack of proper identity verification before the password update is processed, a form of insecure authentication. As a result, an unauthenticated attacker can assume the role of any user, compromising confidentiality, integrity, and availability of the site’s administrative functions. The weakness is classified under CWE-288 and CWE-306, reflecting authentication failure and insecure password handling.

InWave Jobs plugin versions up to and including 3.5.1 for WordPress sites are affected. The vulnerable component is identified by the vendor sfwebservice as "InWave Jobs" and is listed in the CPE string cpe:2.3:a:sfwebservice:injob:*:*:*:*:*:wordpress:*:*.

The CVSS score of 9.8 marks this as a critical vulnerability. However, the EPSS score of less than 1% indicates that historically very few exploits have been observed, and it is not currently listed in the CISA KEV catalog. The likely attack vector is a remote web request to the password reset endpoint, which can be performed without authentication. An attacker could simply send a reset request for any target username and, due to the lack of verification, receive a new password for that account. Once the password is changed, the attacker can log in as the target user and exploit administrative privileges.