CVE-2025-6585 is an improper input validation vulnerability (CWE-20) in the WP JobHunt WordPress plugin affecting all versions up to 7.2. The issue exists in the cs_remove_profile_callback() function, where a user-controlled key is not properly validated, enabling authenticated users with at least Subscriber privileges to delete accounts of other users, including admin accounts. The vulnerability has a CVSS 3.1 base score of 8.1 (High) with network attack vector, low attack complexity, and no user interaction required. No patch or official fix information is currently available from the vendor or other sources.

Exploitation of this vulnerability allows authenticated users with Subscriber-level access or higher to delete arbitrary user accounts, including those of administrators. This can lead to denial of service for affected users and potential loss of administrative control over the WordPress site. The integrity and availability of the site are impacted, but confidentiality is not directly affected according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level user permissions where possible and monitor for suspicious account deletion activity. Avoid granting unnecessary privileges to users. No official patch or temporary fix has been published at this time.