High severity · published Jun 13, 2017
CVE-2017-9603
SQL injection vulnerability in the WP Jobs plugin before 1.5 for WordPress allows authenticated users to execute arbitrary SQL commands via the jobid parameter to…
8.8
CVSS
4.9%
EPSS
No
On KEV
Description
SQL injection vulnerability in the WP Jobs plugin before 1.5 for WordPress allows authenticated users to execute arbitrary SQL commands via the jobid parameter to wp-admin/edit.php.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.9% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WJ
WP Jobs · Intensewp
through 1.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-9603
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-9603
Product
https://wordpress.org/plugins/wp-jobs/#developers
wpvulndb.com
https://wpvulndb.com/vulnerabilities/8847
www.exploit-db.com
https://www.exploit-db.com/exploits/42172/
More from WP Jobs
6.1
CVE-2017-14751
The Intense WP "WP Jobs" plugin 1.5 for WordPress has XSS, related to the Job Qualification field