CVE-2025-5397: Hackers Exploit Jobmonster WordPress Theme to Gain Admin Access

A high-risk security flaw has been discovered in the Jobmonster Job Board WordPress Theme, one of the most popular themes used by job listing websites worldwide. The vulnerability, tracked as CVE-2025-5397, has been rated 9.8 out of 10 on the CVSS severity scale, placing it among the most dangerous WordPress vulnerabilities in recent months.

Security researchers warn that this flaw is under active exploitation, allowing unauthenticated attackers to completely take over affected WordPress websites — including full administrative control.

The Jobmonster theme is a widely used WordPress job board solution that connects employers and job seekers through easy-to-use job listings and application features. According to marketplace data, over 5,600 websites currently use the theme.

Because the theme integrates user login, employer accounts, and applicant information, it often stores sensitive user data — making it a valuable target for cybercriminals.

The flaw originates from a logic error in the theme’s custom login functions, particularly when social login (such as Google or Facebook login) is enabled. The problem lies in the check_login() function, which fails to properly verify the user’s identity before allowing access.

This bug leads to an Authentication Bypass Using an Alternate Path or Channel (CWE-288) — meaning attackers can simply send a crafted network request to the website and log in as any user, including administrators, without needing a valid password or credentials.

Because of its characteristics, the CVE-2025-5397 vulnerability scores a perfect 9.8 (Critical) under the CVSS v3.1 metrics:

• Privileges Required: None (PR:N)

• Attack Complexity: Low (AC:L)

• User Interaction: None

• Impact: High on Confidentiality (C:H), Integrity (I:H), and Availability (A:H)

In simple terms, an attacker doesn’t need any account or special permissions to exploit it — just a direct connection to the target site.

The vulnerability isn’t just theoretical, it’s already being exploited in the wild. According to data from Wordfence, a leading WordPress security provider, their firewall service has blocked more than 1,600 attacks in the last 24 hours specifically targeting this flaw.

These attacks are coming from multiple IP addresses, indicating automated exploitation campaigns designed to hijack vulnerable websites on a large scale.

Once an attacker gains admin access, they can:

• Change or delete website content

• Install malware or backdoors

• Exfiltrate sensitive user and employer data

• Add fake job listings or phishing content

• Use the compromised site to host malicious files or spam campaigns

This level of access effectively gives the attacker total control over the WordPress installation and server.