The WP JobHunt plugin implements an authorization check that fails to enforce the account status when a user attempts to log in. Any authenticated attacker possessing Candidate or Employer privileges can force a successful login even when the account is inactive or pending, allowing them to perform subsequent actions as that user. This flaw corresponds to CWE‑863, which identifies insufficient authorization controls that permit unauthorized access to protected resources.

Affected systems are WordPress sites using the WP JobHunt plugin version 7.6 or earlier, which includes all earlier releases up to and including 7.6. Sites that host the JobCareer theme—one of the major implementations of WP JobHunt—are impacted.

The CVSS score of 5.4 indicates moderate severity, while the EPSS < 1% suggests a low probability of exploitation in the wild. The vulnerability does not allow remote code execution or privilege escalation beyond the authenticated role, but it does enable an attacker to reuse existing credentials on inactive accounts, which can facilitate persistence or credential stuffing attacks. The risk is mitigated by the requirement that the attacker already holds a valid user credential, and the vulnerability is not listed in CISA’s KEV catalog.