Critical · published March 14, 2025
🚨 An unauthenticated attacker can hijack any user's account on WordPress sites using the WP JobHunt plugin! 🔥 Think of it like a hotel manager who can change the name on any guest's booking without verification — a simple call to the front desk could let anyone check into your room! This vulnerability allows malicious users to take over administrator accounts simply by altering email addresses. Once they gain access, they can reset passwords and wreak havoc, potentially compromising sensitive data and site integrity. It's absolutely devastating!
Think of it like a hotel manager who can change the name on any guest's booking without verification — a simple call to the front desk could let anyone check into your room! The WP JobHunt plugin lacks proper identity verification in the account_settings_callback() function, allowing attackers to update user details without authentication, including the email address of administrators.
This vulnerability allows malicious users to take over administrator accounts simply by altering email addresses. Once they gain access, they can reset passwords and wreak havoc, potentially compromising sensitive data and site integrity. It's absolutely devastating! Update the WP JobHunt plugin to version 7.2 or later immediately! It's crucial to implement additional identity checks during user detail updates to prevent unauthorized access. Don't let this slip! You've got this! Act now, and you'll keep your site secure and your users safe! 🛡️