VulnSocial

CVE-2024-11285Disclosure(chimpgroup / jobcareer)

LOWCVSS 9.8 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

The WP JobHunt plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 7.1. This is due to the plugin not properly validating a user's identity prior to updating their details like email via the account_settings_callback() function. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.

chimpgroup CVEsBack to dashboard
1.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-639

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • jobcareer

Threat summary

  • Public PoC is present in monitored signal
  • 1 mentions across 1 observed day

What's happening

  • PoC mentioned or linked in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Affected systems

Vendors
chimpgroup
Products
jobcareer

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-04-08: 1PoC Mentioned / Linked · 2026-04-08: 1Technical Details · 2026-04-08: 104-08
Signal classification1 categories
Disclosure
1100.0%
Referenced assets1 URL
By indicator
Full discourse1 post
  • 0day Signal@0dayPublishing
    Disclosure

    🚨 CVE-2024-11285: WP JobHunt <= 7.1 - Unauthentica... Zero-auth admin takeover via email hijack in account_settings_callback() - classic identity validation bypass that scre... https://zerodaysignal.com/vulnerability/CVE-2024-11285 #netsec #vulnerability #CVE #sysadmin #zeroday

    Post summary

    The post announces CVE-2024-11285, a zero‑auth admin takeover vulnerability in WP JobHunt involving email hijack, and provides a link to additional details but no evidence of active exploitation or patches.

    0000028
    204 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appchimpgroupjobcareer-wordpress-

Explore more

Back to dashboardchimpgroup CVEsjobcareer vulnerabilities