{"id":59790,"date":"2025-08-01T02:22:25","date_gmt":"2025-08-01T02:22:25","guid":{"rendered":""},"modified":"2025-10-21T04:13:15","modified_gmt":"2025-10-21T10:13:15","slug":"cve-2025-6585-wp-jobhunt-plugin-for-wordpress-vulnerable-to-insecure-direct-object-reference","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-6585-wp-jobhunt-plugin-for-wordpress-vulnerable-to-insecure-direct-object-reference\/","title":{"rendered":"CVE-2025-6585: WP JobHunt Plugin for WordPress Vulnerable to Insecure Direct Object Reference<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

The WP JobHunt plugin for WordPress, a popular application used by millions for job board functionality, is currently facing a significant cybersecurity threat. The plugin has been identified with a vulnerability that allows users with minimal privileges to delete the accounts of other users, potentially leading to major data loss or even a system compromise. This vulnerability, identified as CVE-2025-6585, affects all versions up to and including 7.2 of the WP JobHunt plugin. Given the widespread use of WordPress and this plugin<\/a>, this vulnerability poses a serious risk to website owners, businesses, and users alike.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-6585
\nSeverity: High (8.1 CVSS Score)
\nAttack Vector: Network
\nPrivileges Required: Low (Subscriber-level access)
\nUser Interaction: Required
\nImpact: Potential system<\/a> compromise or data leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

WP JobHunt Plugin for WordPress<\/a> | Up to and including 7.2<\/p>\n

How the Exploit Works<\/strong><\/p>\n

The exploit takes advantage of a flaw in the `cs_remove_profile_callback()` function of the WP JobHunt plugin. Specifically, the function fails to validate a user-controlled key<\/a> properly. This oversight enables an authenticated attacker, even with just Subscriber-level access, to delete accounts of other users<\/a>, including admins. The attacker could potentially craft a malicious payload, send it to the vulnerable server, and delete other users’ accounts, thereby gaining unauthorized access<\/a> or causing significant disruption.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

The following pseudocode illustrates what an exploit might look like:<\/p>\n

POST \/wp-jobhunt\/delete-profile HTTP\/1.1\nHost: target.example.com\nContent-Type: application\/json\n{\n\"user_id\": \"[Target User ID]\",\n\"action\": \"delete\"\n}<\/code><\/pre>\n
In this example, the attacker sends a POST request to the vulnerable<\/a> endpoint with a JSON payload containing the user_id of the targeted account and an action set to “delete. Since the `cs_remove_profile_callback()` function does not properly validate the user_id, the server processes the request<\/a>, leading to the deletion of the targeted account.<\/p>\n
Recommendations for Mitigation<\/strong><\/p>\n
The vendor has released a patch to fix this vulnerability<\/a>, and it is highly recommended to apply this patch immediately. If this is not possible, a temporary mitigation can be implemented by using a Web Application Firewall (WAF) or Intrusion Detection System (IDS). These can help block or alert on suspicious activities to reduce the risk of exploitation. Additionally, regular audits of user activity and strong password policies can help prevent unauthorized<\/a> access.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview The WP JobHunt plugin for WordPress, a popular application used by millions for job board functionality, is currently facing a significant cybersecurity threat. The plugin has been identified with a vulnerability that allows users with minimal privileges to delete the accounts of other users, potentially leading to major data loss or even a system […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-59790","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t