Cross-Site Request Forgery Vulnerability in Custom Field for WP Job Manager by WordPress
CVE-2025-30856

4.3MEDIUM

Key Information:

Vendor: WordPress
Status: Custom Field For WP Job Manager
Vendor: CVE Published:; 27 March 2025

What is CVE-2025-30856?

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Custom Field For WP Job Manager plugin, allowing attackers to execute unauthorized actions on behalf of authenticated users. This could result in unintended modifications to the job management processes, potentially exposing sensitive data or altering configurations without user consent. The issue affects all versions from n/a through 1.4, highlighting the importance of timely updates and the implementation of security best practices to mitigate such risks.

Affected Version(s)

Custom Field For WP Job Manager <= 1.4

References

https://patchstack.com/database/wordpress/plugin/custom-f...

vdb-entry

CVSS V3.1

Score:

4.3

Severity:

MEDIUM

Confidentiality:

None

Integrity:

Low

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Mar 27, 2025
Vulnerability Reserved
Mar 26, 2025

Credit

Nguyen Thi Huyen Trang - Skalucy (Patchstack Alliance)