WP JobHunt Plugin Insecure Direct Object Reference Vulnerability Allowing Arbitrary Account Deletion

A vulnerability allowing Insecure Direct Object Reference (IDOR) has been identified in the WP JobHunt plugin for WordPress, affecting all versions through 7.2. The issue arises in the cs_remove_profile_callback() function, where insufficient validation on a user-controlled key enables authenticated attackers with Subscriber-level access and above to delete accounts of other users, including administrators.

Impact

Exploitation of this vulnerability allows for the unauthorized deletion of user accounts, including those of administrators.

Remediation

No known patch is available. Users are advised to review the vulnerability details and consider uninstalling the affected plugin.