CVE-2025-1315

CVE-2025-1315 is a critical privilege escalation vulnerability affecting the InWave Jobs plugin for WordPress, versions up to and including 3.5.1. This flaw allows unauthenticated attackers to reset arbitrary user passwords, including administrators, due to insufficient identity validation during the password reset process. With a CVSS score of 9.8, this vulnerability is easily exploitable over the network with low complexity, leading to complete compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion with 10 mentions, indicating potential interest from threat actors.