CVE-2025-7374

MediumCVSS 5.4

Published: 10/10/2025(UTC)Updated: 19/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

8th percentile - higher than 8% of all known CVEs

Summary

The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to authorization bypass in all versions up to and including 7.6. This is due to insufficient login restrictions on inactive and pending accounts, making it possible for authenticated attackers with Candidate- and Employer-level access and above to log in to the site even if their account is inactive or pending.

Risk Assessment

An attacker could gain access to the site despite account suspension, potentially leading to unauthorized actions such as posting content or accessing data. This may violate the organization's security policy.

Recommendation

Update the WP JobHunt plugin to a version later than 7.6 that fixes the vulnerability. Additionally, review access control mechanisms for inactive and pending accounts.

Other vulnerabilities in WP JobHunt

CVE-2025-7781Medium
The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to Stored Cross-Site Scripting via the 'cs_job_title' parameter in all versions up to and including 7.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Candidate-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Original NVD description (English source)

The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to authorization bypass in all versions up to, and including, 7.6. This is due to insufficient login restrictions on inactive and pending accounts. This makes it possible for authenticated attackers, with Candidate- and Employer-level access and above, to log in to the site even if their account is inactive or pending.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS