CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
What the vulnerability does
The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 via hard-coded credentials. This makes it possible for unauthenticated attackers to extract sensitive data including LinkedIn client and secret keys.
Explanation of Vulnerability in Simple Terms
The Civi Job Board & Freelance Marketplace WordPress theme contains a use of hard-coded cryptographic keys vulnerability affecting versions up to 2.1.4. An attacker can exploit this to decrypt sensitive data or forge authentication tokens without needing to authenticate. The vulnerability requires no user interaction and can be exploited remotely over the network.
What an attacker can do
Decrypt sensitive data or forge authentication tokens using hard-coded cryptographic keys.
Potential impact on your site
User accounts, authentication tokens, and encrypted data may be compromised on affected sites.
Conditions required to exploit
Network access to the WordPress site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
