CVE-2024-13771 Civi - Job Board & Freelance Marketplace WordPress Theme <= 2.1.4 - Authentication Bypass via Password Update
Unauthenticated attackers can change passwords for arbitrary users, including administrators, if they know the username, leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-13771?
CVE-2024-13771 is a critical authentication bypass vulnerability in uxper Civi - Job Board & Freelance Marketplace WordPress Theme, published on 14 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.1.4. This is due to a lack of user validation before changing a password. This makes it possible for unauthenticated attackers to change the password of arbitrary users, including administrators, if the attacker knows the username of the victim.
Which versions are affected by CVE-2024-13771?
It affects 1 product.
Products include Uxper Civi.
How do I fix CVE-2024-13771?
No fix has been published for CVE-2024-13771 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-13771 being exploited?
There is no known exploitation of CVE-2024-13771 in the wild and no public exploit code.
Other vulnerabilities in uxper Civi - Job Board & Freelance Marketplace WordPress Theme
Sources
Also known as GHSA-98c3-q46g-62qh.