The WP JobHunt plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 7.1. This is due to the plugin not properly validating a user's identity prior to updating their details like email via the account_settings_callback() function. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
Metrics
Affected Vendors & Products
References
History
Tue, 08 Jul 2025 15:45:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Chimpgroup
Chimpgroup jobcareer |
|
CPEs | cpe:2.3:a:chimpgroup:jobcareer:*:*:*:*:*:wordpress:*:* | |
Vendors & Products |
Chimpgroup
Chimpgroup jobcareer |
Fri, 14 Mar 2025 16:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
ssvc
|
Fri, 14 Mar 2025 04:45:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Description | The WP JobHunt plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 7.1. This is due to the plugin not properly validating a user's identity prior to updating their details like email via the account_settings_callback() function. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account. | |
Title | WP JobHunt <= 7.1 - Unauthenticated Privilege Escalation via Email Update/Account Takeover | |
Weaknesses | CWE-639 | |
References |
| |
Metrics |
cvssV3_1
|

Status: PUBLISHED
Assigner: Wordfence
Published: 2025-03-14T04:22:31.482Z
Updated: 2025-03-14T15:15:32.900Z
Reserved: 2024-11-15T20:10:43.577Z
Link: CVE-2024-11285

Updated: 2025-03-14T15:14:22.567Z

Status : Analyzed
Published: 2025-03-14T05:15:40.693
Modified: 2025-07-08T15:20:09.593
Link: CVE-2024-11285

No data.