Insecure Direct Object Reference in WP JobHunt Plugin for WordPress

CVE-2025-6585

What is CVE-2025-6585?

The WP JobHunt plugin for WordPress is susceptible to an Insecure Direct Object Reference vulnerability in all versions up to and including 7.2. This occurs due to inadequate validation on a user-controlled key within the cs_remove_profile_callback() function. As a result, authenticated attackers with Subscriber-level access or higher can exploit this flaw to delete the accounts of other users, including administrators. This could lead to significant user data loss and disruption of services, highlighting the importance of stringent validation checks on user inputs.

References