CVE-2018-19487

The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_employer_ajax_profile() function through the admin-ajax.php file, which allows remote unauthenticated attackers to enumerate information about users.

Score

CVSS 3.0 7.5 High

Status

Modified - cve@mitre.org

Published

2019-03-21

Last modified

2024-08-05

Weaknesses

CWE-200

Affected products

• Wp-jobhunt (Wp-jobhunt Project)

References

• https://github.com/Antho59/wp-jobhunt-exploit
• https://wpvulndb.com/vulnerabilities/9206