CVE-2025-7374CWE-863broken-access-control

CVE-2025-7374

Medium · published October 10, 2025

CVSS v3.1
5.4
EPSS
0%
Percentile
8.4
In the wild
Unconfirmed
What it is

The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to authorization bypass in all versions up to, and including, 7.6. This is due to insufficient login restrictions on inactive and pending accounts. This makes it possible for authenticated attackers, with Candidate- and Employer-level access and above, to log in to the site even if their account is inactive or pending.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00192 · 8.4th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2025-10-10T16:15Z
References (2)
https://themeforest.net/item/jobcareer-job-board-responsive-wordpress-theme/14221636 · [email protected]https://www.wordfence.com/threat-intel/vulnerabilities/id/12643dd9-3b5e-45ea-9a64-a5b00c9202c8?source=cve · [email protected]
EPSS history
Timeline
  • 10 OCT 11:17Z
    WP JobHunt <= 7.6 Authenticated (Custom+) Authorization Bypass
    cvelistv5