Technical impact
The Noo JobMonster theme for WordPress is affected by an authentication bypass flaw that allows unauthenticated attackers to acquire administrative privileges, provided that social login functionality is enabled on the site. The vulnerability originates from the check_login() function failing to properly verify a user's identity before granting access, exposing all administrative user accounts. Although this flaw does not directly lead to code execution or data exfiltration, it enables attackers to fully control the WordPress instance, potentially defacing content, publishing malicious posts, or altering site configuration.
Affected Systems
All versions of the Noo JobMonster WordPress theme up to and including 4.8.1 are affected. The flaw specifically impacts installations where the social login feature is enabled, as this activates the vulnerable check_login() code path.
Risk and Exploitability
The vulnerability carries a CVSS score of 9.8, indicating critical severity, yet the EPSS score is less than 1%, implying a low probability of exploitation at this time. The flaw is not listed in CISA KEV. Attackers can exploit it by accessing any page that triggers the check_login() function while social login is active, without needing any credentials. Compromise leads to full administrative control of the WordPress site.
