Cyber Posture

CVE-2024-11285

Critical

Published: 14 March 2025

Published
14 March 2025
Modified
08 July 2025
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0022 45.0th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.

Security Summary

CVE-2024-11285 is a critical privilege escalation vulnerability affecting the WP JobHunt plugin for WordPress in all versions up to and including 7.1. The flaw stems from the plugin's account_settings_callback() function failing to properly validate a user's identity before allowing updates to account details, such as email addresses. This authorization bypass, mapped to CWE-639, enables unauthorized modifications without authentication, earning a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Unauthenticated attackers can exploit this vulnerability remotely over the network with low complexity and no user interaction required. By targeting the account settings endpoint, they can arbitrarily change any user's email address, including those of administrators, then leverage the altered email to initiate a password reset process. Successful exploitation results in full account takeover, granting attackers high confidentiality, integrity, and availability impacts, such as unauthorized access to privileged accounts and potential further compromise of the WordPress site.

Advisories from sources like Wordfence provide detailed threat intelligence on the vulnerability, while the plugin's listing on ThemeForest offers context on the affected JobCareer theme integration. Practitioners should consult these references for patch availability, as the description indicates no built-in mitigations in vulnerable versions, and updating to a fixed release beyond 7.1 is implied as the primary remediation.

Details

CWE(s)
CWE-639

Affected Products

chimpgroup
jobcareer
≤ 7.1

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1098 Account Manipulation Persistence
Adversaries may manipulate accounts to maintain and/or elevate access to victim systems.
attack.mitre.org →
T1078 Valid Accounts Stealth
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
attack.mitre.org →
Why these techniques?

The vulnerability enables remote exploitation of a public-facing WordPress application (T1190), direct unauthorized manipulation of user account details like email addresses (T1098), and subsequent takeover of valid accounts including administrators (T1078).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References