The WP JobHunt plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.9. This is due to the plugin not properly validating a user's identity prior to updating their password through the account_settings_save_callback() function. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
References
Configurations
History
08 Jul 2025, 15:21
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/8afe386e-1e4f-4668-8309-6d47dedb008a?source=cve - Third Party Advisory | |
| References | () https://themeforest.net/item/jobcareer-job-board-responsive-wordpress-theme/14221636 - Product | |
| First Time |
Chimpgroup jobcareer
Chimpgroup |
|
| CPE | cpe:2.3:a:chimpgroup:jobcareer:*:*:*:*:*:wordpress:*:* |
14 Mar 2025, 05:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-03-14 05:15
Updated : 2025-07-08 15:21
NVD link : CVE-2024-11284
Mitre link : CVE-2024-11284
JSON object : View
Products Affected
chimpgroup
- jobcareer
CWE
CWE-639
Authorization Bypass Through User-Controlled Key