CVE-2024-13772
CVSS 3.1 Score 5.9 of 10 (medium)
Details
Published Mar 14, 2025
Updated: Mar 28, 2025
CWE ID 306
CWE ID 288
Summary
CVE-2024-13772: The WordPress plugin "Civi - Job Board & Freelance Marketplace" with versions up to 2.1.4 is susceptible to authentication bypass. This vulnerability arises due to the absence of randomization during Single Sign-On with Google or Facebook, resulting in predictable passwords. An unauthenticated attacker, having knowledge of the victim's username during account creation, can change the password of arbitrary Candidate-level users. This flaw poses a significant risk to websites utilizing this plugin.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.