CVE-2025-7733

Executive Summary

CVE-2025-7733 is an Insecure Direct Object Reference (IDOR) vulnerability found in the WP JobHunt WordPress plugin, which is bundled with the JobCareer theme. The flaw resides in the cs_update_application_status_callback AJAX handler, which fails to properly validate a user-controlled key before sending a site-generated email with injected HTML. This allows an authenticated attacker with at least Candidate-level privileges to send arbitrary HTML content via email to any user on the WordPress site. The vulnerability is present in all versions up to and including 7.7, and no official patch has been released at this time.

Supply Chain & Package Security

This vulnerability affects the WordPress ecosystem via the WP JobHunt plugin. As a third-party plugin distributed through theme bundles and commercial marketplaces, it introduces a supply chain risk. Site administrators must manually verify the plugin version and apply any available updates from the vendor. No official patch or advisory has been published on WordPress.org or GitHub.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Candidate-level)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low (email content injection)
• Availability Impact: None

The low EPSS score (0.0%) suggests this vulnerability is not currently being actively exploited in the wild, but the potential for phishing and social engineering attacks makes it a significant concern for WordPress site operators.

Deep Dive & Mechanics

The vulnerability is triggered through the cs_update_application_status_callback function, which is registered as an AJAX action for authenticated users. This function processes a request to update the status of a job application. The vulnerable code accepts a user_id parameter from the request without verifying that the authenticated user has permission to modify or send emails to that user.

The core issue is that the function uses the provided user_id to retrieve the target user's email address and then sends a status update email. An attacker can inject arbitrary HTML into the email body by manipulating other request parameters (such as the application status message). Since the email is generated by the WordPress site, it appears legitimate to the recipient, increasing the effectiveness of phishing attacks.

The attack flow:

1. Authenticate as a Candidate-level user.
2. Send a crafted AJAX request to wp-admin/admin-ajax.php with action cs_update_application_status.
3. Include a target user_id (any registered user on the site) and malicious HTML in the status message.
4. The plugin sends an email from the site to the target user containing the injected HTML.

Vulnerable vs. Patched Code

Vulnerable Code (wp-jobhunt/includes/class-jobhunt-ajax.php):

public function cs_update_application_status_callback() {
    $user_id = $_POST['user_id'];
    $status = $_POST['status'];
    $application_id = $_POST['application_id'];
    
    // No permission check on $user_id
    $user_info = get_userdata($user_id);
    $to = $user_info->user_email;
    $subject = 'Application Status Updated';
    $message = wp_kses_post($status); // Allows some HTML
    wp_mail($to, $subject, $message);
}

Patched Code (Hypothetical):

public function cs_update_application_status_callback() {
    $application_id = intval($_POST['application_id']);
    $application = get_post($application_id);
    
    // Verify the current user owns the application or is admin
    if (get_current_user_id() != $application->post_author && !current_user_can('administrator')) {
        wp_die('Unauthorized');
    }
    
    $user_id = $application->post_author; // Use the application owner, not user input
    $status = sanitize_text_field($_POST['status']); // Strip all HTML
    $user_info = get_userdata($user_id);
    $to = $user_info->user_email;
    $subject = 'Application Status Updated';
    $message = esc_html($status); // Escape output
    wp_mail($to, $subject, $message);
}

The patched version removes the user-controlled user_id parameter, instead deriving the recipient from the application post itself. It also sanitizes the status message to prevent HTML injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with WP JobHunt plugin version <= 7.7
• An authenticated user account with Candidate-level privileges
• Knowledge of a target user's ID (can be enumerated via other means)

Exploitation Steps:

1. Identify the AJAX action endpoint: The vulnerable endpoint is wp-admin/admin-ajax.php with the action parameter cs_update_application_status.

2. Craft the exploit request:

   curl -X POST 'http://target-site.com/wp-admin/admin-ajax.php' \
   -d 'action=cs_update_application_status' \
   -d 'user_id=2' \
   -d 'application_id=123' \
   -d 'status=<script>alert("XSS")</script><h1>Phishing Email</h1>' \
   --cookie 'wordpress_logged_in_xxx=attacker_session_cookie'
   

3. Verify the attack: The target user (ID 2) will receive an email from the WordPress site containing the injected HTML. This can be used for phishing, credential harvesting, or social engineering.

Note: No public exploit code is available at this time.

Blue Team

Detection and Prevention:

• Monitor AJAX requests to admin-ajax.php with action cs_update_application_status from non-admin users.
• Look for unusual user_id parameters in POST requests that don't match the authenticated user's ID.
• Implement Web Application Firewall (WAF) rules to block requests with HTML tags in the status parameter.
• Restrict the plugin's AJAX handlers to only allow administrators to send emails.

Lab Setup for Testing:

1. Install WordPress and the WP JobHunt plugin (version 7.7 or earlier).
2. Create a Candidate-level user account.
3. Create a target user account (e.g., Subscriber).
4. Use the curl command above to test the vulnerability.
5. Monitor email logs and server access logs for suspicious activity.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /wp-admin/admin-ajax.php with action=cs_update_application_status and a user_id parameter different from the authenticated user.
  • Email headers showing the WordPress site as the sender, but containing unexpected HTML content.

• Host IOCs:

  • WordPress debug logs showing failed permission checks or unusual AJAX calls.
  • Email logs (if using SMTP plugin) showing emails sent to users not associated with the authenticated session.

• File IOCs:

  • Modified or suspicious entries in the wp_jobhunt plugin directory, particularly in includes/class-jobhunt-ajax.php.

Detection Engineering

YARA Rule

rule CVE_2025_7733_WP_JobHunt_IDOR {
    meta:
        description = "Detects exploitation attempts of CVE-2025-7733 in WP JobHunt plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-7733"
        severity = "medium"
    strings:
        $ajax_action = "cs_update_application_status"
        $user_id_param = "user_id"
        $status_param = "status"
        $html_tag = /<[^>]+>/
    condition:
        $ajax_action and $user_id_param and $status_param and #html_tag > 0
}

Sigma Rule

title: CVE-2025-7733 WP JobHunt IDOR Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests targeting the vulnerable AJAX endpoint with HTML injection
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: "admin-ajax.php"
        cs-formdata|contains: 
            - "action=cs_update_application_status"
            - "user_id="
            - "status="
    condition: selection
falsepositives:
    - Legitimate plugin functionality (rare)
level: medium
tags:
    - attack.initial_access
    - attack.t1190

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-7733 WP JobHunt IDOR Exploitation Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"admin-ajax.php"; http_uri;
    content:"action=cs_update_application_status"; http_client_body;
    content:"user_id="; http_client_body;
    content:"status="; http_client_body;
    pcre:"/<[^>]+>/";
    classtype:attempted-user;
    sid:1000001;
    rev:1;
    reference:cve,2025-7733;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the WP JobHunt plugin if it is not essential for business operations.
2. Restrict AJAX handler access by adding a capability check in the plugin code (if you have developer access):

   if (!current_user_can('edit_others_posts')) {
       wp_die('Unauthorized');
   }
   

3. Implement a Web Application Firewall (WAF) rule to block requests containing HTML tags in the status parameter.
4. Monitor email logs for suspicious outbound emails from the WordPress site.

Long-term Fixes:

• Apply the patched code example provided in the "Vulnerable vs. Patched Code" section.
• Contact the plugin vendor for an official patch.
• Consider migrating to an alternative job board plugin that is actively maintained.
• Implement principle of least privilege for all user roles.

Workaround:

• Use a WordPress security plugin (e.g., Wordfence, Sucuri) to add virtual patching for this vulnerability.
• Disable the AJAX handler by adding a filter in your theme's functions.php:

  add_action('wp_ajax_cs_update_application_status', function() {
      wp_die('Disabled for security');
  }, 1);
  

Valters IT - DevSecOps & Cyber Threat Intelligence