What the vulnerability does
01Description
The Noo JobMonster theme for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.8.1. This is due to the check_login() function not properly verifying a user's identity prior to successfully authenticating them This makes it possible for unauthenticated attackers to bypass standard authentication and access administrative user accounts. Please note social login needs to be enabled in order for a site to be impacted by this vulnerability.
Explanation of Vulnerability in Simple Terms
02Summary
Noo JobMonster versions 4.8.1 and earlier contain an authentication bypass vulnerability. An attacker can gain unauthorized access to the application without valid credentials, potentially compromising user data and site functionality. The vulnerability requires no user interaction and can be exploited remotely over the network.
What an attacker can do
03Attacker Capabilities
Gain full unauthorized access to the application without valid login credentials.
Potential impact on your site
04Site Impact
Attackers can read, modify, or delete any data in your JobMonster installation without logging in.
Conditions required to exploit
05Prerequisites
Network access to the affected Noo JobMonster installation; no authentication or user interaction required.
Key dates
06Disclosure timeline
October 31, 2025
CVE published
April 8, 2026
Record updated
