CVE-2025-7374

MEDIUM

WP JobHunt <= 7.6 - Authenticated Authorization Bypass via Inactive Account Login

Title source: llm
STIX 2.1

Description

The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to authorization bypass in all versions up to, and including, 7.6. This is due to insufficient login restrictions on inactive and pending accounts. This makes it possible for authenticated attackers, with Candidate- and Employer-level access and above, to log in to the site even if their account is inactive or pending.

References (2)

Core 2

Scores

CVSS v3 5.4
EPSS 0.0018
EPSS Percentile 7.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-863
Status published
Products (2)
None/WP JobHunt < 7.6
n/a/WP JobHunt < 7.6
Published Oct 10, 2025
Tracked Since Feb 18, 2026