{"id":"CVE-2024-13771","aliases":["EUVD-2024-54060","GHSA-98c3-q46g-62qh"],"status":"published","title":"Civi - Job Board \u0026 Freelance Marketplace WordPress Theme \u003c= 2.1.4 - Authentication Bypass via Password Update","description":"The Civi - Job Board \u0026 Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.1.4. This is due to a lack of user validation before changing a password. This makes it possible for unauthenticated attackers to change the password of arbitrary users, including administrators, if the attacker knows the username of the victim.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00439,"percentile":0.38596,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-288","CWE-306"],"published":"2025-03-14T11:15:52Z","modified":"2026-06-17T07:02:41Z","products":[{"vendor":"uxper","product":"civi"},{"vendor":"uxper","product":"civi - job board \u0026 freelance marketplace wordpress theme"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ab2c74d-b83b-40ea-951c-83aeb76a7515?source=cve","tags":["Third Party Advisory"]},{"url":"https://themeforest.net/item/civi-job-board-wordpress-theme/42770817"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-13771"},{"url":"http://localhost:1337/wp-content/themes/civi/includes/class-ajax.php#L715"},{"url":"https://github.com/advisories/GHSA-98c3-q46g-62qh"}],"sources":{"cve":[{"id":"CVE-2024-13771","title":"Civi - Job Board \u0026 Freelance Marketplace WordPress Theme \u003c= 2.1.4 - Authentication Bypass via Password Update","description":"The Civi - Job Board \u0026 Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.1.4. This is due to a lack of user validation before changing a password. This makes it possible for unauthenticated attackers to change the password of arbitrary users, including administrators, if the attacker knows the username of the victim.","status":"published","published":"2025-03-14T11:15:52.455Z","modified":"2026-04-08T16:55:12.686Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T14:34:13.64024Z"}],"euvd":[{"id":"EUVD-2024-54060","description":"The Civi - Job Board \u0026 Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.1.4. This is due to a lack of user validation before changing a password. This makes it possible for unauthenticated attackers to change the password of arbitrary users, including administrators, if the attacker knows the username of the victim.","status":"published","published":"2025-03-14T11:15:52Z","modified":"2026-04-08T16:55:12Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:24:57.466919Z"}],"ghsa":[{"id":"GHSA-98c3-q46g-62qh","title":"The Civi - Job Board \u0026 Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable...","description":"The Civi - Job Board \u0026 Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.1.4. This is due to a lack of user validation before changing a password. This makes it possible for unauthenticated attackers to change the password of arbitrary users, including administrators, if the attacker knows the username of the victim.","status":"published","published":"2025-03-14T12:32:01Z","modified":"2026-04-08T18:35:27Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-288","CWE-306"],"updated_at":"2026-11-02T15:07:17.92733Z"}],"nvd":[{"id":"CVE-2024-13771","description":"The Civi - Job Board \u0026 Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.1.4. This is due to a lack of user validation before changing a password. This makes it possible for unauthenticated attackers to change the password of arbitrary users, including administrators, if the attacker knows the username of the victim.","status":"published","published":"2025-03-14T12:15:13.693Z","modified":"2026-06-17T07:02:41.443Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-288","CWE-306"],"updated_at":"2026-11-02T14:10:45.422466Z"}]}}