Authentication Bypass in Civi Job Board & Freelance Marketplace WordPress Theme

CVE-2024-13772

What is CVE-2024-13772?

The Civi Job Board & Freelance Marketplace WordPress Theme plugin is prone to an authentication bypass vulnerability affecting all versions up to 2.1.4. This issue arises from inadequate randomization of the password generated during Single Sign-On (SSO) through Google or Facebook. As a result, unauthenticated attackers can potentially alter the passwords of Candidate-level users, provided they know the username assigned during the account setup process. The vulnerability poses significant security risks for users relying on the SSO feature.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References