How severe is CVE-2024-11283?

CVE-2024-11283 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2024-11283 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (33rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-11283?

CVE-2024-11283 affects Chimpgroup Jobcareer. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2024-11283?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2024-11283 have an EU (EUVD) identifier?

Yes. CVE-2024-11283 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-54066.

When was CVE-2024-11283 published?

CVE-2024-11283 was published on 2025-03-14 and last updated on 2026-06-17.

CVE-2024-11283

CVE-2024-11283 is a high-severity vulnerability in Chimpgroup Jobcareer with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-289.

Key facts

Severity: High (CVSS 3.x base score 7.5)
EPSS exploit prediction: 0% (33rd percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-54066
Weakness: CWE-289
Affected product: Chimpgroup Jobcareer
Published: 2025-03-14
Last modified: 2026-06-17

Description

The WP JobHunt plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 7.1. This is due to wp_ajax_google_api_login_callback function not properly verifying a user's identity prior to authenticating them. This makes it possible for unauthenticated attackers to access arbitrary candidate accounts.

Frequently asked questions

What is CVE-2024-11283?: The WP JobHunt plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 7.1. This is due to wp_ajax_google_api_login_callback function not properly verifying a user's identity prior to authenticating them. This makes it possible for unauthenticated attackers to access arbitrary candidate accounts.
How severe is CVE-2024-11283?: CVE-2024-11283 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2024-11283 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (33rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-11283?: CVE-2024-11283 affects Chimpgroup Jobcareer. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-11283?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2024-11283 have an EU (EUVD) identifier?: Yes. CVE-2024-11283 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-54066.
When was CVE-2024-11283 published?: CVE-2024-11283 was published on 2025-03-14 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:chimpgroup:jobcareer:*:*:*:*:*:wordpress:*:*

More vulnerabilities in Chimpgroup Jobcareer

CVE-2024-11286 — Critical (CVSS 9.8): The WP JobHunt plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 7.1.…
CVE-2024-11285 — Critical (CVSS 9.8): The WP JobHunt plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to,…
CVE-2024-11284 — Critical (CVSS 9.8): The WP JobHunt plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to,…
CVE-2024-12810 — High (CVSS 8.8): The JobCareer | Job Board Responsive WordPress Theme theme for WordPress is vulnerable to unauthorized access,…

All CVEs affecting Chimpgroup Jobcareer →

Other CWE-289 vulnerabilities

CVE-2026-9701 — Critical (CVSS 9.8): The Eventer plugin for WordPress is vulnerable to an insecure password reset mechanism in all versions up to, and…
CVE-2026-24058 — Critical (CVSS 9.8): Soft Serve is a self-hostable Git server for the command line. Versions 0.11.2 and below have a critical authentication…
CVE-2025-13613 — Critical (CVSS 9.8): The Elated Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including,…
CVE-2024-56511 — Critical (CVSS 9.8): DataEase is an open source data visualization analysis tool. Prior to 2.10.4, there is a flaw in the authentication in…
CVE-2023-1803 — Critical (CVSS 9.8): Authentication Bypass by Alternate Name vulnerability in DTS Electronics Redline Router firmware allows Authentication…
CVE-2025-29266 — Critical (CVSS 9.6): Unraid 7.0.0 before 7.0.1 allows remote users to access the Unraid WebGUI and web console as root without…

Browse all CWE-289 vulnerabilities →