CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.1.4. This is due to a lack of user validation before changing a password. This makes it possible for unauthenticated attackers to change the password of arbitrary users, including administrators, if the attacker knows the username of the victim.
Explanation of Vulnerability in Simple Terms
The Civi Job Board & Freelance Marketplace WordPress theme contains an authentication bypass vulnerability affecting versions up to 2.1.4. An attacker can gain unauthorized access to the site without valid credentials, potentially compromising user data, site content, and availability. The vulnerability requires no user interaction and can be exploited remotely over the network.
What an attacker can do
Gain unauthorized access to the site and read/modify sensitive data or disable the site.
Potential impact on your site
Attackers can access your site without a password, steal user data, modify content, or take the site offline.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
