CVE-2024-11285: 
WordPress vulnerability analysis and mitigation

The WP JobHunt plugin for WordPress contains a critical privilege escalation vulnerability (CVE-2024-11285) discovered in all versions up to and including 7.1. The vulnerability was disclosed on March 14, 2025. This security issue affects the WordPress plugin's user account management functionality (NVD).

The vulnerability stems from improper validation of user identity in the account_settings_callback() function before updating user details like email addresses. This implementation flaw allows unauthenticated attackers to modify arbitrary users' email addresses, including administrators. The vulnerability has received a CVSS v3.1 base score of 9.8 CRITICAL (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is classified as CWE-639 (Authorization Bypass Through User-Controlled Key) (NVD).

The vulnerability enables unauthenticated attackers to change any user's email address, including administrators. Once an attacker changes a user's email address, they can leverage this to perform password resets and gain unauthorized access to user accounts. This effectively allows complete account takeover of any user account in the system (NVD).

The vulnerability is highly exploitable as it requires no authentication (unauthenticated attack), no user interaction, and has low attack complexity. The attack can be performed remotely over the network, making it particularly dangerous (NVD).

Users should immediately update the WP JobHunt plugin to a version newer than 7.1 if available. Until an update is available, site administrators should consider disabling the plugin or implementing additional security controls to prevent unauthorized access to user account settings (NVD).