WP JobHunt Plugin Insecure Direct Object Reference Vulnerability

A vulnerability allowing Insecure Direct Object Reference has been identified in the WP JobHunt plugin for WordPress, specifically in versions through 7.7. This vulnerability arises from missing validation on a user-controlled key in the 'cs_update_application_status_callback' function. As a result, authenticated attackers with Candidate-level access or higher can exploit this issue to send a site-generated email containing injected HTML to any user.

Impact

Exploitation of this vulnerability allows for the injection of HTML into emails sent to users, which could be used for phishing or other malicious purposes.