Careerfy <= 7.0 - Cross-Site Request Forgery and Missing Authorization
Strategic Overview
<= 7.0N/AVulnerability Overview
The Careerfy theme for WordPress is vulnerable to authorization bypass & Cross-Site Request Forgery in versions up to, and including, 7.0. This is due to missing nonce validation and capability checks on several functions. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to trigger several AJAX actions that can perform operations like importing jobs and modifyig custom settings. This can also be exploited via CSRF.
Technical Analysis
REMEDIATION: Update to version 7.1.0, or a newer patched version --- IDENTIFIER: CWE-862 (Missing Authorization) The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C