Authentication Bypass in Civi Job Board & Freelance Marketplace WordPress Theme

CVE-2024-13772

Summary

The Civi Job Board & Freelance Marketplace WordPress Theme plugin is prone to an authentication bypass vulnerability affecting all versions up to 2.1.4. This issue arises from inadequate randomization of the password generated during Single Sign-On (SSO) through Google or Facebook. As a result, unauthenticated attackers can potentially alter the passwords of Candidate-level users, provided they know the username assigned during the account setup process. The vulnerability poses significant security risks for users relying on the SSO feature.

References