CVE-2025-39477
Unknown Unknown - Not Provided
Missing Authorization in InWave Jobs Sfwebservice Allows Unauthorized Access

Publication date: 2026-01-06

Last updated on: 2026-04-28

Assigner: Patchstack

Description
Missing Authorization vulnerability in Sfwebservice InWave Jobs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects InWave Jobs: from n/a through 3.5.8.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-06
Last Modified
2026-04-28
Generated
2026-06-16
AI Q&A
2026-01-06
EPSS Evaluated
2026-06-15
NVD
CVE-2025-39477
EUVD
EUVD-2026-1007
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
inwave jobs From 3.0.0 (inc) to 3.5.8 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2025-39477 is a high-severity Broken Access Control vulnerability in the WordPress InWave Jobs plugin (up to version 3.5.8). It occurs due to missing authorization, authentication, or nonce token checks in certain plugin functions, which allows unauthenticated users to perform actions that should be restricted to higher-privileged users. [1]

Impact Analysis

This vulnerability can have a severe impact as it allows attackers without authentication to execute privileged actions, potentially leading to full compromise of the affected website. The CVSS score of 9.8 indicates it can result in complete confidentiality, integrity, and availability loss of the system. [1]

Mitigation Strategies

Apply the mitigation rule issued by Patchstack immediately to block attacks until an official patch is released. Users are strongly advised to implement this mitigation to protect their websites from exploitation of the missing authorization vulnerability in the InWave Jobs plugin versions up to 3.5.8. [1]

Detection Guidance

There is no specific information provided about detection commands or methods for this vulnerability. However, Patchstack has issued a mitigation rule to block attacks until an official patch is released. Users are advised to apply this mitigation immediately. For detection, monitoring for unauthorized access attempts or unusual activity related to the InWave Jobs plugin may help, but no explicit commands or detection techniques are detailed in the provided resources. [1]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-39477. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart