Critical · published March 14, 2025
🚨 A simple username is all an attacker needs to take control! This critical vulnerability in the Civi - Job Board & Freelance Marketplace WordPress Theme plugin allows unauthenticated users to change any user's password — including those of site administrators. 🔥 Think of it like a hotel where anyone can walk up to the front desk, say a guest's name, and obtain a new key card without any verification. Just like that front desk, this plugin skips the crucial step of checking if the requester is the actual guest! If exploited, an attacker could change the passwords of any user, effectively locking them out of their accounts and gaining unauthorized access to sensitive areas of the site. This could lead to complete administrative control, potentially exposing user data or manipulating site content. The fallout could be absolutely devastating!
Think of it like a hotel where anyone can walk up to the front desk, say a guest's name, and obtain a new key card without any verification. Just like that front desk, this plugin skips the crucial step of checking if the requester is the actual guest! This authentication bypass stems from a lack of user validation before allowing password changes. The vulnerability affects all versions of the plugin up to and including 2.1.4, enabling attackers to impersonate users if they know their usernames.
If exploited, an attacker could change the passwords of any user, effectively locking them out of their accounts and gaining unauthorized access to sensitive areas of the site. This could lead to complete administrative control, potentially exposing user data or manipulating site content. The fallout could be absolutely devastating! To protect your site, immediately update the Civi - Job Board & Freelance Marketplace plugin to version 2.1.5 or higher. Additionally, review your user access controls and consider adding extra authentication measures to prevent unauthorized password changes. Act now! You've got this! Follow these steps and secure your site like a superhero! 🛡️