WordPress JobHunt Job Alerts Missing Authorization Vulnerability Allowing Arbitrary Content Deletion

A missing authorization vulnerability has been identified in the WordPress JobHunt Job Alerts plugin, affecting versions through 3.6. This vulnerability allows for arbitrary content deletion by exploiting incorrectly configured access control security levels. As a result, a malicious actor could potentially delete various types of content from a website, such as posts, pages, or media files.

Impact

Exploitation of this vulnerability could lead to unauthorized deletion of content from the affected WordPress site, including posts, pages, or media.

Remediation

Users of the WordPress JobHunt Job Alerts plugin are advised to update to version 3.6 or later. For those unable to update immediately, Patchstack offers a virtual patch that can be applied to mitigate this vulnerability.