CVE-2025-7374

The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to authorization bypass in all versions up to, and including, 7.6. This is due to insufficient login restrictions on inactive and pending accounts. This makes it possible for authenticated attackers, with Candidate- and Employer-level access and above, to log in to the site even if their account is inactive or pending.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://themeforest.net/item/jobcareer-job-board-responsive-wordpress-theme/14221636
https://www.wordfence.com/threat-intel/vulnerabilities/id/12643dd9-3b5e-45ea-9a64-a5b00c9202c8?source=cve

Configurations

No configuration.

History

19 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) El plugin WP JobHunt para WordPress, utilizado por el tema JobCareer, es vulnerable a una omisión de autorización en todas las versiones hasta la 7.6, inclusive. Esto se debe a restricciones de inicio de sesión insuficientes en cuentas inactivas y pendientes. Esto permite que atacantes autenticados, con acceso de nivel Candidato y Empleador o superior, inicien sesión en el sitio incluso si su cuenta está inactiva o pendiente.

Information

Published : 2025-10-10 12:15

Updated : 2026-10-19 16:10

NVD link : CVE-2025-7374

Mitre link : CVE-2025-7374

CVE.ORG link : CVE-2025-7374

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2025-7374", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-7374", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-10T12:01:39.474255Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@wordfence.com", "affectedData": [{"vendor": "n/a", "product": "WP JobHunt", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "7.6"}], "defaultStatus": "unaffected"}]}], "published": "2025-10-10T12:15:37.937", "references": [{"url": "https://themeforest.net/item/jobcareer-job-board-responsive-wordpress-theme/14221636", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/12643dd9-3b5e-45ea-9a64-a5b00c9202c8?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to authorization bypass in all versions up to, and including, 7.6. This is due to insufficient login restrictions on inactive and pending accounts. This makes it possible for authenticated attackers, with Candidate- and Employer-level access and above, to log in to the site even if their account is inactive or pending."}, {"lang": "es", "value": "El plugin WP JobHunt para WordPress, utilizado por el tema JobCareer, es vulnerable a una omisi\u00f3n de autorizaci\u00f3n en todas las versiones hasta la 7.6, inclusive. Esto se debe a restricciones de inicio de sesi\u00f3n insuficientes en cuentas inactivas y pendientes. Esto permite que atacantes autenticados, con acceso de nivel Candidato y Empleador o superior, inicien sesi\u00f3n en el sitio incluso si su cuenta est\u00e1 inactiva o pendiente."}], "lastModified": "2026-10-19T16:10:00.260", "sourceIdentifier": "security@wordfence.com"}