CVE-2024-11285: Chimpgroup Jobcareer Privilege Escalation

CVE-2024-11285 Overview

CVE-2024-11285 is a critical privilege escalation vulnerability affecting the WP JobHunt plugin for WordPress. The vulnerability exists in all versions up to and including 7.1, where the plugin fails to properly validate a user's identity prior to updating their account details through the account_settings_callback() function. This authentication bypass allows unauthenticated attackers to modify arbitrary user email addresses, including administrator accounts, enabling complete account takeover through password reset mechanisms.

Critical Impact

Unauthenticated attackers can take over any WordPress account, including administrators, by changing email addresses and initiating password resets—leading to complete site compromise.

Affected Products

• WP JobHunt plugin for WordPress versions up to and including 7.1
• Chimpgroup JobCareer WordPress theme/plugin ecosystem
• WordPress sites utilizing the JobCareer job board functionality

Discovery Timeline

• 2025-03-14 - CVE-2024-11285 published to NVD
• 2025-07-08 - Last updated in NVD database

Technical Details for CVE-2024-11285

Vulnerability Analysis

This vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), representing a fundamental failure in access control implementation. The account_settings_callback() function processes user profile update requests without verifying that the requesting user has authorization to modify the target account. This design flaw enables attackers to manipulate user identifiers in requests to update account details for any user on the system.

The attack chain is straightforward: an attacker sends a crafted request to modify the email address associated with an administrator account, then uses WordPress's standard password reset functionality with the newly assigned email address to gain full control of the account. This provides complete administrative access to the WordPress installation.

Root Cause

The root cause lies in improper authorization validation within the account_settings_callback() function. The plugin accepts user-supplied identifiers without verifying that the authenticated session (or lack thereof) corresponds to the account being modified. This represents an Insecure Direct Object Reference (IDOR) vulnerability where user-controlled input directly references backend objects without proper access control checks.

Attack Vector

The vulnerability is exploitable over the network without any authentication requirements. An attacker can target any WordPress site running a vulnerable version of the WP JobHunt plugin by:

1. Identifying the target user account (typically an administrator)
2. Sending a malicious request to the account_settings_callback() endpoint with the target user's identifier and a new email address controlled by the attacker
3. Initiating a password reset for the administrator account using the newly assigned email
4. Using the password reset link to establish new credentials
5. Logging in with full administrative privileges

The attack requires no user interaction and can be automated for mass exploitation. Once administrative access is obtained, attackers can install malicious plugins, inject backdoors, modify site content, or pivot to attack the underlying server infrastructure.

Detection Methods for CVE-2024-11285

Indicators of Compromise

• Unexpected email address changes on user accounts, particularly administrator accounts
• Password reset emails sent to unfamiliar email addresses for existing user accounts
• Unusual requests to the WP JobHunt account settings endpoints from unauthenticated sessions
• New administrator accounts created without authorization
• Modified or newly installed WordPress plugins or themes following unauthorized access

Detection Strategies

• Monitor WordPress user table for unauthorized email address modifications using database auditing
• Implement web application firewall rules to detect and block requests to account_settings_callback() from unauthenticated sources
• Review WordPress activity logs for password reset requests involving recently changed email addresses
• Deploy intrusion detection signatures that identify the account takeover attack pattern
• Audit user account modifications and correlate with authenticated session data

Monitoring Recommendations

• Enable comprehensive WordPress activity logging including user profile changes
• Configure alerts for administrator account modifications outside of normal administrative sessions
• Monitor for bulk reconnaissance or exploitation attempts targeting the vulnerable endpoint
• Implement real-time alerting for password reset requests involving administrator accounts
• Track failed and successful authentication attempts following user account modifications

How to Mitigate CVE-2024-11285

Immediate Actions Required

• Update the WP JobHunt plugin to the latest patched version immediately
• Audit all user accounts, especially administrators, for unauthorized email address changes
• Reset passwords for any accounts showing signs of compromise or modification
• Review WordPress site for indicators of unauthorized access or malicious modifications
• Consider temporarily disabling the WP JobHunt plugin if an update is not immediately available

Patch Information

Organizations should update to a patched version of the WP JobHunt plugin as soon as one becomes available. The Wordfence Vulnerability Report provides detailed tracking information, while the plugin can be obtained through the ThemeForest Job Board Theme marketplace. Administrators should subscribe to security notifications from both Wordfence and the plugin vendor to receive timely update alerts.

Workarounds

• Restrict access to the vulnerable account_settings_callback() function via web server configuration or WordPress firewall rules
• Implement additional authentication checks at the web application firewall level for sensitive user modification endpoints
• Use a WordPress security plugin to add extra validation layers for account modification requests
• Consider implementing two-factor authentication on administrator accounts to add a secondary protection layer even if credentials are compromised
• Temporarily disable user profile self-service functionality until the patch is applied

# WordPress .htaccess configuration to restrict access to vulnerable endpoint
# Add to .htaccess in wp-content/plugins/wp-jobhunt/ directory

<IfModule mod_rewrite.c>
    RewriteEngine On
    # Block unauthenticated requests to account settings callback
    RewriteCond %{REQUEST_URI} account_settings_callback [NC]
    RewriteCond %{HTTP_COOKIE} !wordpress_logged_in [NC]
    RewriteRule .* - [F,L]
</IfModule>