CVE-2025-6585

HIGH

WP JobHunt <7.2 - Insecure Direct Object Reference

Title source: llm
STIX 2.1

Description

The WP JobHunt plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 7.2 via the cs_remove_profile_callback() function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete accounts of other users including admins.

References (2)

Core 2

Scores

CVSS v3 8.1
EPSS 0.0039
EPSS Percentile 30.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-20
Status published
Products (2)
None/WP JobHunt < 7.2
n/a/WP JobHunt < 7.2
Published Jul 22, 2025
Tracked Since Feb 18, 2026