The JobSearch WP Job Board plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.6.7. This is due to the plugin not properly verifying a users identity when verifying an email address through the user_account_activation function. This makes it possible for unauthenticated attackers to log in as any user, including site administrators if the users email is known.
Metrics
Affected Vendors & Products
References
History
Fri, 29 Nov 2024 16:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Eyecix
Eyecix jobsearch Wp Job Board |
|
CPEs | cpe:2.3:a:eyecix:jobsearch_wp_job_board:-:*:*:*:*:wordpress:*:* | |
Vendors & Products |
Eyecix
Eyecix jobsearch Wp Job Board |
|
Metrics |
ssvc
|
Thu, 28 Nov 2024 07:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Description | The JobSearch WP Job Board plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.6.7. This is due to the plugin not properly verifying a users identity when verifying an email address through the user_account_activation function. This makes it possible for unauthenticated attackers to log in as any user, including site administrators if the users email is known. | |
Title | WP JobSearch <= 2.6.7 - Authentication Bypass to Account Takeover and Privilege Escalation | |
Weaknesses | CWE-288 | |
References |
| |
Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: Wordfence
Published: 2024-11-28T07:14:07.539Z
Updated: 2024-11-29T15:35:07.980Z
Reserved: 2024-11-27T18:26:49.008Z
Link: CVE-2024-11925
Vulnrichment
Updated: 2024-11-29T15:35:02.260Z
NVD
Status : Received
Published: 2024-11-28T07:15:05.267
Modified: 2024-11-28T07:15:05.267
Link: CVE-2024-11925
Redhat
No data.