Civi Job Board and Freelance Marketplace WordPress Theme Authentication Bypass Vulnerability

An authentication bypass vulnerability has been identified in the Civi - Job Board & Freelance Marketplace WordPress Theme, affecting all versions through 2.1.4. The vulnerability arises from inadequate user validation before password changes, allowing unauthenticated attackers to reset the passwords of any users, including administrators, if they know the username.

Impact

Exploitation of this vulnerability allows for unauthorized password changes, potentially leading to unauthorized access to user accounts, including those of administrators.

Remediation

There is no known patch available for this vulnerability. Users are advised to review the vulnerability details and consider uninstalling the affected theme.