CVE-2025-32146
📋 TL;DR
This vulnerability allows attackers to include local files on the server through improper input validation in JS Job Manager's PHP code. Attackers can read sensitive files like configuration files, potentially leading to further compromise. All WordPress sites running JS Job Manager versions up to 2.0.2 are affected.
💻 Affected Systems
- JS Job Manager (WordPress plugin)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise through reading sensitive configuration files (like wp-config.php) containing database credentials, followed by database takeover and potential remote code execution.
Likely Case
Information disclosure of sensitive files, potentially exposing database credentials, user data, or other configuration secrets.
If Mitigated
Limited impact if file permissions restrict access to sensitive files or if web server runs with minimal privileges.
🎯 Exploit Status
Simple path traversal or file inclusion payloads can trigger the vulnerability without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.3 or later
Vendor Advisory: https://patchstack.com/database/wordpress/plugin/js-jobs/vulnerability/wordpress-js-job-manager-plugin-2-0-2-local-file-inclusion-vulnerability?_s_id=cve
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find JS Job Manager and update to version 2.0.3 or later. 4. Verify update completes successfully.
🔧 Temporary Workarounds
Disable vulnerable plugin
allTemporarily disable JS Job Manager plugin until patched
wp plugin deactivate js-jobs
Restrict file access via .htaccess
linuxAdd rules to block file inclusion attempts
RewriteCond %{QUERY_STRING} (.*\.\./|.*\.php) [NC]
RewriteRule ^ - [F,L]
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block file inclusion patterns
- Restrict web server permissions to prevent reading sensitive files
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → Installed Plugins for JS Job Manager versionCheck Version:
wp plugin list --name=js-jobs --field=versionVerify Fix Applied:
Confirm plugin version is 2.0.3 or higher in WordPress admin📡 Detection & Monitoring
Log Indicators:
- HTTP requests with file inclusion patterns in query strings
- Access to sensitive files like wp-config.php from web paths
Network Indicators:
- Unusual file paths in HTTP GET parameters
- Requests to plugin-specific endpoints with traversal sequences
SIEM Query:
web.url:*js-jobs* AND (web.query:*../* OR web.query:*.php*)