Authorization Bypass Vulnerability in WP JobHunt Plugin by WordPress

CVE-2025-7374

What is CVE-2025-7374?

The WP JobHunt plugin for WordPress, leveraged by the JobCareer theme, is susceptible to an authorization bypass. This vulnerability stems from inadequate login controls applied to inactive and pending user accounts. As a result, authenticated attackers possessing Candidate- or Employer-level access can gain login privileges to the site, even if their accounts are marked as inactive or awaiting activation, potentially compromising sensitive site functionality and data.

References