High severity8.1NVD Advisory· Published Jul 22, 2025· Updated Apr 15, 2026

CVE-2025-6585

Description

The WP JobHunt plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 7.2 via the cs_remove_profile_callback() function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete accounts of other users including admins.

Affected products

JobCareer/WP JobHuntllm-fuzzy
Range: <=7.2
WordPress/Wp Jobhuntwp-canonicalize
Package: https://wordpress.org/plugins/wp-jobhunt

Patches

Vulnerability mechanics

References

themeforest.net/item/jobcareer-job-board-responsive-wordpress-theme/14221636nvd
www.wordfence.com/threat-intel/vulnerabilities/id/afb3e0e0-68c7-43f6-981f-59c3f3507429nvd

News mentions

No linked articles in our index yet.

cvss	0.526
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000