PT-2025-11254 · WordPress · Civi - Job Board & Freelance Marketplace Wordpress Theme

Lucio Sá · Published 2025-03-14 · Updated 2026-04-08 · CVE-2024-13771

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Civi - Job Board & Freelance Marketplace WordPress Theme plugin versions up to, and including, 2.1.4

Description: The issue is due to a lack of user validation before changing a password, making it possible for unauthenticated attackers to change the password of arbitrary users, including administrators, if the attacker knows the username of the victim.

Recommendations: For versions up to, and including, 2.1.4, update to a version that includes the fix for this issue to prevent authentication bypass. As a temporary workaround, consider restricting access to password change functionality until a patch is available.

Fix

Authentication Bypass Using an Alternate Path or Channel

Missing Authentication

Weakness Enumeration

CWE-288

CWE-306

Related Identifiers

CVE-2024-13771

Affected Products

Civi - Job Board & Freelance Marketplace Wordpress Theme

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2024-13771 · Security Note
• https://osv.dev/vulnerability/CVE-2024-13771 · Vendor Advisory
• https://twitter.com/cybercronai/status/1900533019124826584 · Twitter Post
• https://themeforest.net/item/civi-job-board-wordpress-theme/42770817 · Note
• https://t.me/cvedetector/20289 · Telegram Post
• https://twitter.com/CVEnew/status/1900511452416340090 · Twitter Post
• https://t.me/cvetracker/19115 · Telegram Post
• http://localhost:1337/wp-content/themes/civi/includes/class-ajax.php#L715 · Note
• https://t.me/cvenotify/116450 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/5ab2c74d-b83b-40ea-951c-83aeb76a7515?source=cve · Note
• https://twitter.com/0dayPublishing/status/2041937642292416954 · Twitter Post
• https://twitter.com/vulns_space/status/1900533862964273179 · Twitter Post
• https://twitter.com/CveFindCom/status/1900510138709979233 · Twitter Post