What is the CVSS score of CVE-2026-22340?

CVE-2026-22340 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.4%.

Which versions of WPJobster are affected by CVE-2026-22340?

WPJobster WordPress theme versions 6.3.5 and earlier contain a critical unauthenticated SQL injection vulnerability that permits remote attackers to access, modify, or extract sensitive database…

How to fix or mitigate CVE-2026-22340?

Within 24 hours: Deactivate WPJobster theme versions 6.3.5 and earlier and switch to a patched alternative theme; update WordPress core, all plugins, and MySQL to latest stable versions. Within 7 days: Deploy Web Application Firewall (WAF) rules to block SQL injection patterns targeting theme endpoints; conduct database access log review for indicators of compromise; audit database user permissions to enforce least-privilege. Within 30 days: Monitor Patchstack security advisory and official WordPress plugin repository for vendor patch release; prepare permanent theme replacement plan or migration timeline if patch does not materialize.

WPJobster CVE-2026-22340

EUVD-2026-37660 CRITICAL

SQL Injection (CWE-89)

2026-06-17 Patchstack

WordPress SQLi Wpjobster Wordpress Theme

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

9.1 CRITICAL

Unauthenticated network-reachable SQLi in a WordPress theme typically yields full read and write to the WordPress database (C:H/I:H); scope kept Unchanged as injection stays within the WP DB authorization boundary.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:30 vuln.today

DescriptionCVE.org

Unauthenticated SQL Injection in WPJobster <= 6.3.5 versions.

AnalysisAI

Unauthenticated SQL injection in the WPJobster WordPress theme versions 6.3.5 and earlier allows remote attackers to inject SQL queries without any authentication or user interaction. Reported by Patchstack and tracked under CWE-89, the issue carries a CVSS 3.1 score of 9.3 with a scope-changed impact, meaning a successful injection can affect resources beyond the vulnerable component. No public exploit identified at time of analysis, but the network-reachable, low-complexity nature of WordPress theme endpoints makes this a high-priority issue for any site running the affected theme.

Technical ContextAI

WPJobster is a commercial WordPress theme (CPE cpe:2.3:a:jobster_marketplace:wpjobster) used to build job marketplace sites, typically exposing job listing, search, and AJAX-driven endpoints to unauthenticated visitors. CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) indicates that user-supplied input reaches a WordPress database query (likely via $wpdb) without proper parameterization or sanitization through wpdb->prepare(), esc_sql(), or sanitize_text_field(). Because the theme layer runs inside WordPress, injected SQL executes with the privileges of the wp_user database account, which by default has full read/write access to all WordPress tables including wp_users and wp_options.

RemediationAI

No vendor-released patch identified at time of analysis from the provided data; site operators should monitor the Patchstack advisory (https://patchstack.com/database/wordpress/theme/wpjobster/vulnerability/wordpress-wpjobster-theme-6-3-5-sql-injection-vulnerability) and the theme vendor's changelog for a version above 6.3.5 and upgrade immediately when released. In the interim, deploy a WordPress WAF with SQLi signatures (Patchstack, Wordfence, or Cloudflare managed rules) tuned to block UNION/SELECT and tautology patterns on WPJobster theme endpoints - note this can produce false positives on legitimate search queries containing SQL keywords. Where feasible, restrict access to the vulnerable AJAX/search endpoints via IP allowlisting or temporarily disable the affected feature in the theme settings, and rotate WordPress secret keys, admin passwords, and any API tokens stored in wp_options after applying the fix in case data was already extracted.