CVE-2024-11286

The vulnerability results from improper user identity verification in the cs_parse_request() function. The plugin does not properly check whether the requester is actually who they claim to be before proceeding with the authentication process. As a result, an attacker can send a crafted request and obtain a session for any user without providing correct login credentials. The absence of any prerequisites (no authorization, no user interaction) makes the attack trivial to perform remotely.

An attacker can gain full control of the WordPress website by logging in as an administrator, enabling content modification, installation of malicious plugins, theft of user data, and further actions within the infrastructure.

The WP JobHunt plugin should be updated to a version higher than 7.1. Patches available from the vendor should be applied according to references. Until the update is completed, it is recommended to disable the plugin or restrict access to the website at the firewall level.

The WP JobHunt plugin for WordPress in all versions up to and including 7.1 (product associated with the Jobcareer theme by Chimpgroup).