PT-2025-11233 · WordPress · Wp Jobhunt

Tonn

·

Published

2025-03-14

·

Updated

2025-07-08

·

CVE-2024-11284

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions: WP JobHunt plugin for WordPress versions up to, and including, 6.9
Description: The issue is related to privilege escalation via account takeover. This is due to the plugin not properly validating a user's identity prior to updating their password through the account settings save callback() function. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
Recommendations: For versions up to, and including, 6.9, update to a version that fixes this issue to prevent privilege escalation via account takeover. As a temporary workaround, consider disabling the account settings save callback() function until a patch is available.

Fix

LPE

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2024-11284

Affected Products

Wp Jobhunt