CVE-2025-7374: CWE-863 Incorrect Authorization in WP JobHunt
The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to authorization bypass in all versions up to, and including, 7.6. This is due to insufficient login restrictions on inactive and pending accounts. This makes it possible for authenticated attackers, with Candidate- and Employer-level access and above, to log in to the site even if their account is inactive or pending.
AI Analysis
Technical Summary
The WP JobHunt plugin for WordPress contains an authorization bypass vulnerability (CWE-863) due to insufficient login restrictions on inactive and pending accounts. Authenticated users with Candidate or Employer roles can bypass these restrictions and log in even if their accounts are inactive or pending. This affects all versions up to and including 7.6. The vulnerability has a CVSS 3.1 base score of 5.4, indicating medium severity. No patch or remediation details have been provided, and no known exploits have been reported.
Potential Impact
An attacker with authenticated access at Candidate or Employer level can bypass account status restrictions and log in with inactive or pending accounts. This could allow unauthorized access to site functionality intended only for active users, potentially leading to limited confidentiality and integrity impacts. There is no indication of availability impact or privilege escalation beyond the existing roles.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting user roles and monitoring account status enforcement as a temporary measure. Avoid granting unnecessary Candidate or Employer-level access to untrusted users.
CVE-2025-7374: CWE-863 Incorrect Authorization in WP JobHunt
Description
The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to authorization bypass in all versions up to, and including, 7.6. This is due to insufficient login restrictions on inactive and pending accounts. This makes it possible for authenticated attackers, with Candidate- and Employer-level access and above, to log in to the site even if their account is inactive or pending.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The WP JobHunt plugin for WordPress contains an authorization bypass vulnerability (CWE-863) due to insufficient login restrictions on inactive and pending accounts. Authenticated users with Candidate or Employer roles can bypass these restrictions and log in even if their accounts are inactive or pending. This affects all versions up to and including 7.6. The vulnerability has a CVSS 3.1 base score of 5.4, indicating medium severity. No patch or remediation details have been provided, and no known exploits have been reported.
Potential Impact
An attacker with authenticated access at Candidate or Employer level can bypass account status restrictions and log in with inactive or pending accounts. This could allow unauthorized access to site functionality intended only for active users, potentially leading to limited confidentiality and integrity impacts. There is no indication of availability impact or privilege escalation beyond the existing roles.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting user roles and monitoring account status enforcement as a temporary measure. Avoid granting unnecessary Candidate or Employer-level access to untrusted users.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- Wordfence
- Date Reserved
- 2025-07-08T22:51:00.471Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 68e8f247395901574383ec06
Added to database: 10/10/2025, 11:47:19 AM
Last enriched: 4/9/2026, 9:42:12 PM
Last updated: 5/10/2026, 1:03:19 AM
Views: 138
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.