CVE-2026-22340: WordPress WPJobster theme <= 6.3.5 - SQL Injection vulnerability

Synopsis

An unauthenticated SQL injection vulnerability affects the WPJobster WordPress theme at version 6.3.5 and below. The flaw is reachable over the network without any login or account, and it uses a changed scope (S:C), meaning the database server outside the theme itself can be impacted. Successful exploitation allows an attacker to read sensitive data from the database and cause limited service disruption. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the WordPress installation via HTTP/HTTPS from any internet-adjacent position.

• AuthenticationNot required

  No account or credentials of any kind are needed; the injection is reachable by any unauthenticated HTTP request.

• Victim interactionNot required

  No user action or social engineering is required; the attacker sends a crafted request directly to the server.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental prerequisites.

Blast Radius

• Attacker reads arbitrary database contents, including stored user credentials, session tokens, personal information, and any other data accessible to the database user.
• The changed scope (S:C) means the SQL injection can affect the underlying database server beyond the WordPress application boundary, potentially reaching data belonging to other applications sharing the same database instance.
• Limited availability impact allows the attacker to degrade or partially disrupt database responsiveness, affecting site functionality for legitimate users.