CVE-2025-6585
BaseFortify
Publication date: 2025-07-22
Last updated on: 2025-07-22
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordpress | wp_jobhunt | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an Insecure Direct Object Reference (IDOR) in the WP JobHunt WordPress plugin up to version 7.2. It occurs in the cs_remove_profile_callback() function because it lacks proper validation on a user-controlled key. This allows authenticated users with Subscriber-level access or higher to delete other users' accounts, including administrators.
How can this vulnerability impact me? :
The vulnerability can allow an attacker with low-level authenticated access to delete accounts of other users, including administrators. This can lead to loss of administrative control, disruption of website operations, and potential unauthorized access or denial of service.