Unauthenticated Attackers Can Easily Escalate Privileges on JobSearch WP Job Board Plugin

CVE-2024-11925

Summary

The JobSearch WP Job Board plugin for WordPress allows unauthenticated attackers to exploit a privilege escalation vulnerability stemming from inadequate verification of user identities during the email address verification process in the user_account_activation function. This security flaw affects all versions up to and including 2.6.7, enabling unauthorized users to log in as any registered user, potentially including site administrators, provided they have knowledge of the users' email addresses. The oversight creates significant security risks for WordPress sites utilizing this plugin, necessitating prompt action to secure the affected installations.

References