CVE-2024-11925 is an authentication bypass vulnerability in the JobSearch WP Job Board WordPress plugin (versions up to 2.6.7). The vulnerability stems from the plugin's failure to properly verify user identity during the email verification process in the user_account_activation function. This allows unauthenticated attackers to escalate privileges and log in as arbitrary users, including administrators, if they know the target's email address. The vulnerability is classified under CWE-288 (Authentication Bypass Using an Alternate Path or Channel) and carries a CVSS 3.1 base score of 9.8 (critical). No patch or remediation details are currently available from the vendor, and the product is not a cloud service.

Successful exploitation allows an unauthenticated attacker to bypass authentication controls and gain access to any user account, including administrative accounts. This leads to full compromise of the affected WordPress site, impacting confidentiality, integrity, and availability of the system. Given the critical CVSS score of 9.8, the impact is severe.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable plugin to prevent exploitation. Monitoring for updates from the vendor eyecix is strongly recommended. No vendor advisory or official patch information is currently available.