CVE-2025-2010 is an SQL Injection vulnerability in the JobWP – Job Board, Job Listing, Career Page and Recruitment Plugin for WordPress, affecting all versions up to 2.3.9. The issue arises from insufficient escaping of the 'jobwp_upload_resume' parameter and lack of proper SQL query preparation, enabling unauthenticated attackers to append arbitrary SQL commands. This can be used to extract sensitive information from the backend database. The vulnerability is classified under CWE-89 and has a CVSS v3.1 base score of 7.5, indicating high severity. No patch or official fix has been documented, and the plugin is not a cloud service, so remediation depends on vendor updates or user action.

Successful exploitation allows unauthenticated attackers to perform SQL Injection attacks, potentially extracting sensitive data from the database. The vulnerability does not impact integrity or availability directly but compromises confidentiality. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable parameter or plugin functionality. Monitoring for updates from the vendor mhmrajib is recommended.