PT-2024-17205 · WordPress · Wp Job Portal

Thevietronin · Published 2024-12-14 · Updated 2025-02-06 · CVE-2024-11715

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WP Job Portal – A Complete Recruitment System plugin for WordPress versions up to, and including, 2.2.2

Description The WP Job Portal plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the assignUserRole() function. This allows unauthenticated attackers to elevate their privileges to that of an employer.

Recommendations For versions up to, and including, 2.2.2, update to a version later than 2.2.2 to resolve the issue. As a temporary workaround, consider disabling the assignUserRole() function until a patch is available.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-11715

Affected Products

Wp Job Portal

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2024-11715 · Security Note
• https://plugins.trac.wordpress.org/changeset/3202327/wp-job-portal/tags/2.2.3/modules/user/controller.php?old=3187129&old_path=wp-job-portal%2Ftags%2F2.2.2%2Fmodules%2Fuser%2Fcontroller.php · Patch
• https://osv.dev/vulnerability/CVE-2024-11715 · Vendor Advisory
• https://twitter.com/CVEnew/status/1867908453525585932 · Twitter Post
• https://gist.github.com/tvnnn/9b706643c5f88989c98815be8b101e11 · Note
• https://twitter.com/VulmonFeeds/status/1867843902922801384 · Twitter Post
• https://twitter.com/transilienceai/status/1869249706217357457 · Twitter Post
• https://twitter.com/transilienceai/status/1869249717634240990 · Twitter Post
• https://t.me/cvedetector/12941 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/4107199d-e3c7-4379-b39d-1868de7d777b?source=cve · Note
• https://t.me/cvenotify/110223 · Telegram Post
• https://t.me/cvenotify/104310 · Telegram Post