Vulnerability · Published Mar 14, 2025 · Assigned by Wordfence

CVE-2024-13772Civi - Job Board & Freelance Marketplace WordPress Theme <= 2.1.6.1 - Authentication Bypass

Medium 5.6

In plain English

A medium-severity authentication bypass in Civi - Job Board & Freelance Marketplace WordPress Theme from uxper. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)5.6Medium

Exploit odds (30 days)0.3%top 79.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.1.6.1. This is due to a lack of password randomization and user validation through the fb_ajax_login_or_register and google_ajax_login_or_register actions. This makes it possible for unauthenticated attackers to login as any user as long as they have access to the email.

Affected products (as reported)

Vendor	Product	Versions
uxper	Civi - Job Board & Freelance Marketplace WordPress Theme	0 – through 2.1.6.1

Weakness: CWE-288 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

In plain English

Official description

Affected products (as reported)

References