Technical impact
An unauthenticated SQL injection flaw exists in WPJobster theme versions 6.3.5 and earlier, as detailed in the description. While the CVE text does not enumerate specific exploitation steps, it is inferred that attackers can send specially crafted HTTP requests which the theme processes as database queries, in line with common SQL injection patterns. This vulnerability follows the CWE‑89 pattern and, when successfully exploited, can lead to disclosure of database contents and modification of data stored in the WordPress database. If the database account has high privileges, the attacker may perform further malicious actions. The stated impact is therefore inferred from typical SQL injection behaviors.
Affected Systems
WordPress sites that have the WPJobster theme from Jobster Marketplace installed at version 6.3.5 or earlier are affected. The theme must be active and the site must be reachable via public HTTP traffic. Any installation that has not upgraded the theme to a patched version becomes vulnerable.
Risk and Exploitability
The CVSS score of 9.3 categorises the flaw as critical. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploits. Nonetheless, due to the unauthenticated nature and high severity, a skilled attacker could exploit the flaw through crafted HTTP requests directed at the theme’s front‑end pages, potentially compromising the WordPress database. Sites with weak or overly privileged database credentials are at higher risk.
