CVE-2024-11283 Details
Description
The WP JobHunt plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 7.1. This is due to wp_ajax_google_api_login_callback function not properly verifying a user's identity prior to authenticating them. This makes it possible for unauthenticated attackers to access arbitrary candidate accounts.
A vulnerability allowing authentication bypass has been identified in the WP JobHunt plugin for WordPress, affecting all versions through 7.1. The issue arises because the 'wp_ajax_google_api_login_callback' function fails to properly verify user identity before authentication. This flaw enables unauthenticated attackers to access any candidate's account.
There is no known patch available for this vulnerability. It is recommended to review the vulnerability details thoroughly and consider uninstalling the affected plugin.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 14, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-289 | Authentication Bypass by Alternate Name | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| chimpgroup jobcareer | <= 7.1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2025 | Initial Analysis | [email protected] |
| Mar 14, 2025 | New CVE Received | [email protected] |