CWE
288 306
Advisory Published
Updated

CVE-2024-13771: Civi - Job Board & Freelance Marketplace WordPress Theme <= 2.1.4 - Authentication Bypass via Password Update

First published: Fri Mar 14 2025(Updated: )

The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.1.4. This is due to a lack of user validation before changing a password. This makes it possible for unauthenticated attackers to change the password of arbitrary users, including administrators, if the attacker knows the username of the victim.

Credit: security@wordfence.com

Affected SoftwareAffected VersionHow to fix
Civi Job Board & Freelance Marketplace WordPress Theme<=2.1.4
CiviWordpress<=2.1.4

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Frequently Asked Questions

  • What is the severity of CVE-2024-13771?

    CVE-2024-13771 has been assessed to have a high severity due to the potential for unauthorized access through authentication bypass.

  • How do I fix CVE-2024-13771?

    To fix CVE-2024-13771, update the Civi Job Board & Freelance Marketplace WordPress Theme plugin to version 2.1.5 or newer.

  • Who is affected by CVE-2024-13771?

    Any users of the Civi Job Board & Freelance Marketplace WordPress Theme plugin version 2.1.4 or earlier are affected by CVE-2024-13771.

  • What kind of attack is possible with CVE-2024-13771?

    CVE-2024-13771 allows unauthenticated attackers to bypass user authentication and potentially change user passwords.

  • When was CVE-2024-13771 published?

    CVE-2024-13771 was published on April 10, 2024.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203