WP JobHunt Plugin for WordPress Authorization Bypass Vulnerability

A vulnerability allowing authorization bypass has been identified in the WP JobHunt plugin for WordPress, specifically in versions through 7.6. This issue arises from inadequate login restrictions on inactive and pending accounts, enabling authenticated attackers with Candidate or Employer-level access to log in despite their accounts being inactive or pending.

Impact

Exploitation of this vulnerability allows authenticated users to bypass account status restrictions, potentially leading to unauthorized access or actions on the site.

Remediation

Users can update to WP JobHunt version 7.7 or a newer patched version to address this vulnerability.