CVE-2024-11285: WP JobHunt <= 7.1 - Unauthenticated Privilege Escalation via Email Update/Account Takeover
The WP JobHunt plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 7.1. This is due to the plugin not properly validating a user's identity prior to updating their details like email via the accountsettingscallback() function. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-11285?
CVE-2024-11285 is classified as a privilege escalation vulnerability that can lead to account takeover.
How do I fix CVE-2024-11285?
To fix CVE-2024-11285, update the WP JobHunt plugin to version 7.2 or later.
What versions of WP JobHunt are affected by CVE-2024-11285?
CVE-2024-11285 affects all versions of the WP JobHunt plugin up to and including 7.1.
What is the risk of exploitation for CVE-2024-11285?
The risk of exploitation for CVE-2024-11285 is significant as it allows attackers to gain unauthorized access to user accounts.
Who should be concerned about CVE-2024-11285?
Website administrators using the WP JobHunt plugin should be concerned about CVE-2024-11285 and take steps to secure their sites.