Critical authentication bypass flaw in JobMonster WordPress theme actively exploited
Take action: This is important but urgent ONLY if you have JobMonster with Social Login active. If your site has all these functions, update ASAP. Alternatively, rotate your admin email and username to something new and difficult to guess to get a bit of breathing room and time to test out things.
Learn More
Hackers are repoorted to be actively exploiting a security vulnerability in the JobMonster WordPress theme that enables attackers to hijack administrator accounts and gain complete control over affected websites.
The vulnerability is tracked as CVE-2025-5397 (CVSS score 9.8) - Improper authentication handling in the check_login() function. The theme trusts the authentication information received from social login providers without verification mechanisms. In a typical attack scenario, an attacker would also need to know the target administrator's account username or email address. Once this information is obtained through reconnaissance or publicly available sources, the attacker can exploit the authentication bypass to gain administrative access to the website without the actual account password.
Prerequisite for successful exploitation is that the social login feature must be enabled on websites using the JobMonster theme, such as "Sign in with Google," "Login with Facebook," or "Continue with LinkedIn." When this feature is disabled, websites are not impacted.
The flaw affects all versions of the theme up to and including version 4.8.1. WordPress security firm Wordfence detected the malicious activity after blocking multiple exploit attempts against its clients over the past 24 hours.
NooThemes has patched the flaw in JobMonster version 4.8.2. Website administrators using any version of JobMonster are strongly advised to update to the patched version 4.8.2.
Oganizations that can't update should disable the social login functionality on affected websites, or rotating the administrator username and email to something new and difficult to guess. These measures must be considered as temporary mitigations.
