A high-severity insecure direct object reference vulnerability in the WP JobHunt plugin for WordPress allows authenticated attackers to perform unauthorized account deletion, including administrative accounts.

This vulnerability is an Insecure Direct Object Reference (IDOR) flaw located in the cs_remove_profile_callback function. It permits authenticated attackers with Subscriber-level access or higher to bypass permission checks and delete any user account on the affected WordPress installation.

The ability for low-privileged users to delete administrative accounts poses a critical threat to site integrity and availability. A successful exploit results in total account takeover or site lockout, leading to significant operational downtime, potential data loss, and unauthorized access to the underlying WordPress environment. With a CVSS score of 8.1, this flaw is categorized as High severity, necessitating immediate attention to prevent unauthorized administrative escalation.

Immediate Action: As no patched version is currently available, administrators should immediately deactivate and remove the WP JobHunt plugin until a security update is released by the vendor.

Proactive Monitoring: Review WordPress user account logs and audit trails for unauthorized deletions or unexpected changes to administrative privileges.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules to monitor and block requests targeting the cs_remove_profile_callback function.

Public Exploit Available: No (exploit_available: unknown).

Given the severity of the impact and the current lack of a vendor-provided patch, the primary recommendation is the immediate removal of the vulnerable plugin. Security teams should prioritize identifying all instances of the WP JobHunt plugin within their environment and ensure that administrative accounts are secured and monitored for any unauthorized access or modification attempts.