PT-2025-30378 · WordPress · Wp Jobhunt

Meghnine Islem · Published 2025-07-22 · Updated 2025-07-22 · CVE-2025-6585

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions WP JobHunt versions prior to 7.3

Description The WP JobHunt plugin for WordPress is susceptible to an Insecure Direct Object Reference issue in all versions up to and including 7.2, specifically within the cs remove profile callback() function. This is due to a lack of validation on a user-controlled key. Authenticated attackers with Subscriber-level access or higher can exploit this to delete accounts belonging to other users, including administrators.

Recommendations Update WP JobHunt to version 7.3 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2025-6585

Affected Products

Wp Jobhunt

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-6585 · Security Note
• https://themeforest.net/item/jobcareer-job-board-responsive-wordpress-theme/14221636 · Note
• https://t.me/cvenotify/129771 · Telegram Post
• https://t.me/cvetracker/28354 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/afb3e0e0-68c7-43f6-981f-59c3f3507429?source=cve · Note
• https://t.me/CVEtracker/28354 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1947538007860400581 · Twitter Post