Critical · published March 14, 2025
🚨 A missing identity check allows attackers to change any user's password, including admins, in the WP JobHunt plugin! 🔥 Think of it like a restaurant where anyone can walk in, claim to be a staff member, and order changes to the menu without a single question — chaos ensues! An attacker could swoop in and take over accounts, potentially leading to unauthorized access to sensitive data or even complete admin control. This means they could wreak havoc and make devastating changes across the board!
Think of it like a restaurant where anyone can walk in, claim to be a staff member, and order changes to the menu without a single question — chaos ensues! The vulnerability arises because the WP JobHunt plugin fails to validate a user's identity before allowing password changes through the account_settings_save_callback() function, enabling unauthorized password updates.
An attacker could swoop in and take over accounts, potentially leading to unauthorized access to sensitive data or even complete admin control. This means they could wreak havoc and make devastating changes across the board! Patch to version 6.9.1 immediately to close this loophole. Additionally, conduct an audit of user account activities for any suspicious changes that may have occurred. 🔒 You've got this! Follow the steps to secure your site and become a hero for your users! 🛡️