CVE-2024-13771

CRITICAL

Civi WordPress Theme <= 2.1.4 - Unauthenticated Authentication Bypass

Title source: llm

Description

The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.1.4. This is due to a lack of user validation before changing a password. This makes it possible for unauthenticated attackers to change the password of arbitrary users, including administrators, if the attacker knows the username of the victim.

References (3)

Core 3

Core References

https://themeforest.net/item/civi-job-board-wordpress-theme/42770817

Broken Link

http://localhost:1337/wp-content/themes/civi/includes/class-ajax.php#L715

Third Party Advisory

https://www.wordfence.com/threat-intel/vulnerabilities/id/5ab2c74d-b83b-40ea-951c-83aeb76a7515?source=cve

Scores

CVSS v3 9.8

EPSS 0.0041

EPSS Percentile 32.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

Details

CWE

CWE-288 CWE-306

Status published

Products (2)

uxper/civi < 2.1.4

uxper/Civi - Job Board & Freelance Marketplace WordPress Theme < 2.1.4

Published Mar 14, 2025

Tracked Since Feb 18, 2026