CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
What the vulnerability does
The WP JobHunt plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 7.2 via the cs_remove_profile_callback() function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete accounts of other users including admins.
Explanation of Vulnerability in Simple Terms
WP JobHunt versions 7.2 and earlier contain an input validation flaw that allows authenticated users to modify or delete site data. An attacker with a low-privilege account can exploit this without user interaction to corrupt job listings, user records, or other critical content. The vulnerability does not expose sensitive information but can severely disrupt site operations.
What an attacker can do
Modify or delete site data including job listings and user records without authorization.
Potential impact on your site
Job listings and user data can be corrupted or deleted by low-privilege accounts, disrupting site functionality.
Conditions required to exploit
Attacker must have a low-privilege user account on the site; no user interaction required.
Key dates
External resources
