PT-2025-2166 · WordPress · Wp Job Portal
Thevietronin
·
Published
2025-02-01
·
Updated
2025-03-02
·
CVE-2024-13425
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress versions up to, and including, 2.2.6
Description
The issue is related to Insecure Direct Object Reference, which affects the plugin due to missing validation on a
key controlled by the user. This allows authenticated attackers with Employer-level access and above to delete other users' companies via the enforcedelete() function.Recommendations
For versions up to, and including, 2.2.6, consider disabling the
enforcedelete() function until a patch is available to prevent unauthorized deletion of companies. Restrict access to the enforcedelete() function to minimize the risk of exploitation. Avoid using the key variable in the affected function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.IDOR
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Wp Job Portal