CVE-2025-7733 is an authorization bypass vulnerability in the WP JobHunt plugin for WordPress, affecting all versions up to 7.7. The issue arises from an insecure direct object reference caused by missing validation on a user-controlled key within the 'cs_update_application_status_callback' function. This flaw enables authenticated users with Candidate-level privileges or above to send emails generated by the site that include injected HTML content to arbitrary users. The vulnerability is classified under CWE-639 and has a CVSS 3.1 base score of 4.3, indicating medium severity.

An attacker with authenticated Candidate-level access or higher can exploit this vulnerability to send emails with injected HTML content to any user of the site. This could potentially be used for phishing or social engineering attacks leveraging the trusted email channel. There is no direct impact on confidentiality or availability reported, and no known active exploitation in the wild has been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Candidate-level access to trusted users only and monitor for suspicious email activity. Avoid relying on the plugin's email functionality for sensitive communications. Follow updates from the WP JobHunt plugin vendor or WordPress security advisories for official patches or temporary mitigations.