{"id":"CVE-2024-13772","aliases":["EUVD-2024-54059","GHSA-jrw2-pv6m-v2w5"],"status":"published","title":"Civi - Job Board \u0026 Freelance Marketplace WordPress Theme \u003c= 2.1.6.1 - Authentication Bypass","description":"The Civi - Job Board \u0026 Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.1.6.1. This is due to a lack of password randomization and user validation through the fb_ajax_login_or_register and google_ajax_login_or_register actions. This makes it possible for unauthenticated attackers to login as any user as long as they have access to the email.","severity":{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00283,"percentile":0.20998,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-288","CWE-306"],"published":"2025-03-14T11:15:53Z","modified":"2026-06-17T07:02:41Z","products":[{"vendor":"uxper","product":"civi"},{"vendor":"uxper","product":"civi - job board \u0026 freelance marketplace wordpress theme"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf04f458-7900-4dd3-84fb-169b74db97ab?source=cve","tags":["Third Party Advisory"]},{"url":"https://themeforest.net/item/civi-job-board-wordpress-theme/42770817#item-description__changelogs"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-13772"},{"url":"http://localhost:1337/wp-content/themes/civi/includes/class-ajax.php#L567"},{"url":"http://localhost:1337/wp-content/themes/civi/includes/class-ajax.php#L739"},{"url":"https://github.com/advisories/GHSA-jrw2-pv6m-v2w5"}],"sources":{"cve":[{"id":"CVE-2024-13772","title":"Civi - Job Board \u0026 Freelance Marketplace WordPress Theme \u003c= 2.1.6.1 - Authentication Bypass","description":"The Civi - Job Board \u0026 Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.1.6.1. This is due to a lack of password randomization and user validation through the fb_ajax_login_or_register and google_ajax_login_or_register actions. This makes it possible for unauthenticated attackers to login as any user as long as they have access to the email.","status":"published","published":"2025-03-14T11:15:53.188Z","modified":"2026-04-08T17:19:21.991Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T14:34:13.321108Z"}],"euvd":[{"id":"EUVD-2024-54059","description":"The Civi - Job Board \u0026 Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.1.6.1. This is due to a lack of password randomization and user validation through the fb_ajax_login_or_register and google_ajax_login_or_register actions. This makes it possible for unauthenticated attackers to login as any user as long as they have access to the email.","status":"published","published":"2025-03-14T11:15:53Z","modified":"2026-04-08T17:19:21Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T19:24:42.318475Z"}],"ghsa":[{"id":"GHSA-jrw2-pv6m-v2w5","title":"The Civi - Job Board \u0026 Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable...","description":"The Civi - Job Board \u0026 Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.1.4. This is due to a lack of randomization of a password created during Single Sign-On via Google or Facebook. This makes it possible for unauthenticated attackers to change the password of arbitrary Candidate-level users if the attacker knows the username assigned to the victim during account creation.","status":"published","published":"2025-03-14T12:32:01Z","modified":"2025-06-17T18:32:43Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-288","CWE-306"],"updated_at":"2026-11-02T15:02:45.097525Z"}],"nvd":[{"id":"CVE-2024-13772","description":"The Civi - Job Board \u0026 Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.1.6.1. This is due to a lack of password randomization and user validation through the fb_ajax_login_or_register and google_ajax_login_or_register actions. This makes it possible for unauthenticated attackers to login as any user as long as they have access to the email.","status":"published","published":"2025-03-14T12:15:13.907Z","modified":"2026-06-17T07:02:41.577Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-288","CWE-306"],"updated_at":"2026-11-02T14:10:45.422466Z"}]}}