PT-2025-11234 · WordPress · Wp Jobhunt

Tonn

·

Published

2025-03-14

·

Updated

2026-04-08

·

CVE-2024-11285

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions: WP JobHunt plugin for WordPress versions up to, and including, 7.1
Description: The issue is related to privilege escalation via account takeover. This occurs because the plugin does not properly validate a user's identity before updating their details, such as email, via the account settings callback() function. As a result, unauthenticated attackers can change arbitrary users' email addresses, including those of administrators, and then reset the user's password to gain access to their account.
Recommendations: For versions up to, and including, 7.1, consider disabling the account settings callback() function until a patch is available to prevent unauthenticated attackers from changing user email addresses. Restrict access to user account settings to minimize the risk of exploitation. Avoid using the affected plugin until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2024-11285

Affected Products

Wp Jobhunt