WP JobHunt WordPress Plugin Privilege Escalation Vulnerability Allowing Account Takeover

A privilege escalation vulnerability allowing account takeover has been identified in the WP JobHunt plugin for WordPress, affecting all versions through 6.9. The issue arises because the plugin fails to properly validate a user's identity before allowing password changes through the account_settings_save_callback() function. This flaw enables unauthenticated attackers to change the passwords of any user, including administrators, and gain access to their accounts.

Impact

Exploitation of this vulnerability allows for unauthorized password changes, leading to account takeover, including access to administrator accounts.