Authentication Bypass Vulnerability in Civi Job Board & Freelance Marketplace Plugin

CVE-2024-13771

Summary

The Civi Job Board & Freelance Marketplace plugin for WordPress has a vulnerability that allows unauthenticated users to bypass authentication measures. In all versions up to and including 2.1.4, this flaw occurs due to insufficient user validation processes before password changes. An attacker who knows the username can leverage this vulnerability to change the passwords of arbitrary users, including those with administrator privileges, thus gaining unauthorized access to sensitive areas of the system.

References