PT-2025-11235 · WordPress · Wp Jobhunt

Tonn

·

Published

2025-03-14

·

Updated

2025-07-08

·

CVE-2024-11286

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions: WP JobHunt plugin for WordPress versions up to, and including, 7.1
Description: The issue is related to authentication bypass due to the plugin not properly verifying a user's identity prior to authenticating them through the cs parse request() function. This allows unauthenticated attackers to log in to any user's account, including administrators.
Recommendations: For WP JobHunt plugin for WordPress versions up to, and including, 7.1, update to a version that includes the fix for this issue to prevent authentication bypass. As a temporary workaround, consider restricting access to sensitive areas of the website to minimize the risk of exploitation until a patch is available.

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2024-11286

Affected Products

Wp Jobhunt