CVE-2025-32660 is a critical (CVSS 10.0) unrestricted file upload in JoomSky's JS Job Manager plugin (js-jobs) for WordPress, in versions through 2.0.2. The record says it allows a web shell to be uploaded to the server. No fix is named, so update to the latest release or remove the plugin.
What's affected
JS Job Manager (slug js-jobs) through version 2.0.2, per the CVE record and its Patchstack source. The record does not name a fixed release, so check the plugin's change log for any version after 2.0.2.
The record describes an unrestricted upload of a file with a dangerous type, with the stated outcome of uploading a web shell. The vector shows no login and no user interaction, with a changed scope, which is the pattern behind a 10.0 score.
Job boards expect uploads such as resumes and logos, so upload handling is a normal feature here. The weakness is that the type of file is not restricted enough. See CVE-2025-32626 for the SQL injection in the same plugin.
How to check if you're exposed
Check which version is installed:
wp plugin get js-jobs
Then look at where uploads are stored. In a default WordPress layout that is under wp-content/uploads. List recently added files with executable extensions, such as PHP files, in that tree:
find wp-content/uploads -name '*.php' -mtime -90
Uploads should not normally contain PHP files. Any hit deserves a careful look, and you should compare it against your backups.
What to do now
- Update the plugin to a release newer than 2.0.2, or deactivate and delete it if none exists.
- Block execution of PHP in the uploads directory with a web server rule.
- Scan the site files for unexpected PHP files and for changes to core, theme and plugin files.
- Rotate WordPress administrator passwords, database credentials and any API keys stored on the host if you find signs of compromise.
- Restore from a known good backup if the site was altered, and then update before bringing it back online.
Why it matters
The class is CWE-434 (Unrestricted File Upload). The plugin accepted a file whose type was not checked well enough. A PHP file placed in a web readable path can be run by simply requesting it, which turns an upload form into a way to run code.
Defense in depth helps here. Even when a plugin has this bug, a server that refuses to execute scripts from the uploads folder blunts the impact. Configure that rule once for every site.
The record does not mark this CVE as CISA KEV and makes no claim of exploitation in the wild.
Quick check
Why does this score 10.0 and the SQL injection 9.3?
The upload flaw affects confidentiality, integrity and availability all at the highest level in the vector. The SQL injection rates high confidentiality but only low availability impact and no integrity impact.
Sources
Last reviewed: 18 October 2026.
