CVE-2025-7374
WP JobHunt <= 7.6 Authenticated (Custom+) Authorization Bypass
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th
The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to authorization bypass in all versions up to, and including, 7.6. This is due to insufficient login restrictions on inactive and pending accounts. This makes it possible for authenticated attackers, with Candidate- and Employer-level access and above, to log in to the site even if their account is inactive or pending.
| CWE | CWE-863 |
| Vendor | n/a |
| Product | wp jobhunt |
| Published | Oct 10, 2025 |
| Last Updated | Apr 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for n/a wp jobhunt
Be the first to know when new medium vulnerabilities affecting n/a wp jobhunt are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
n/a / WP JobHunt
0 ≤ 7.6
References
Credits
meghnine islem