CVE-2025-7374
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-10

Last updated on: 2025-10-14

Assigner: Wordfence

Description
The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to authorization bypass in all versions up to, and including, 7.6. This is due to insufficient login restrictions on inactive and pending accounts. This makes it possible for authenticated attackers, with Candidate- and Employer-level access and above, to log in to the site even if their account is inactive or pending.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-10
Last Modified
2025-10-14
Generated
2026-05-07
AI Q&A
2025-10-10
EPSS Evaluated
2026-05-05
NVD
CVE-2025-7374
EUVD
EUVD-2025-33709
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
wordpress wp_jobhunt *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

The vulnerability in the WP JobHunt plugin for WordPress allows authenticated users with Candidate- or Employer-level access and above to bypass authorization restrictions. Specifically, users can log in even if their accounts are inactive or pending because the plugin does not properly restrict login for these account states.


How can this vulnerability impact me? :

This vulnerability can allow unauthorized access by users whose accounts should not be active, potentially leading to unauthorized actions or access to sensitive information within the site. It undermines the intended account status controls and could lead to misuse of the platform by users who should not have access.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart