Unauthorized Data Modification in WP JobHunt Plugin for WordPress

CVE-2025-7782

What is CVE-2025-7782?

The WP JobHunt plugin for WordPress has a security flaw that allows authenticated users with Candidate-level access or higher to manipulate job application statuses. This vulnerability arises from a missing capability check in the 'cs_update_application_status_callback' function. As a result, unauthorized modifications can occur, enabling attackers to inject malicious scripts into the 'status' field of job applications. This exploitation poses serious risks to data integrity and user security, affecting users applied to jobs through the JobCareer theme.

References