The WP JobHunt plugin for WordPress contains an authentication bypass vulnerability (CWE-289) identified as CVE-2024-11283. This issue is due to improper verification of user identity in the wp_ajax_google_api_login_callback function, which handles Google API login callbacks. As a result, unauthenticated attackers can bypass authentication controls and gain access to arbitrary candidate accounts. The vulnerability affects all versions up to and including 7.1. The CVSS 3.1 score of 7.5 indicates a high-severity flaw exploitable remotely without authentication or user interaction, leading to unauthorized access to sensitive account data. No patch or remediation details are currently available, and no known exploits have been reported in the wild.

Successful exploitation allows unauthenticated attackers to bypass authentication and access arbitrary candidate accounts within the WP JobHunt plugin. This compromises the confidentiality of candidate data. There is no indication of impact on integrity or availability. The vulnerability is remotely exploitable without any privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling the affected Google API login functionality or restricting access to the wp_ajax_google_api_login_callback endpoint if possible. Monitor vendor channels for updates and apply patches promptly once available.