The WP JobHunt plugin for WordPress contains an authorization bypass vulnerability (CWE-639) due to insufficient validation of user identity before updating account details such as email addresses. This allows unauthenticated attackers to modify any user's email address, including administrators, and subsequently reset their passwords to gain unauthorized access. The vulnerability affects all versions up to and including 7.1. The CVSS 3.1 base score is 9.8, reflecting its critical severity with network attack vector, no required privileges or user interaction, and full confidentiality, integrity, and availability impact.

Successful exploitation enables an attacker to take over any user account by changing the email address and resetting the password, leading to full compromise of affected accounts, including administrative accounts. This can result in complete site takeover, data loss, and unauthorized administrative actions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin's account management endpoints and monitor for suspicious activity. Avoid using affected versions of WP JobHunt and consider disabling the plugin if possible until patched.