Paper/Archive/CVE-2024-11715

CVE-2024-11715

wpjobportal WP Job Portal – AI-Powered Recruitment System for Company or Job Board website — WP Job Portal <= 2.2.2 - Missing Authorization to Limited Privilege Escalation

EPSS 0.5%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 40.3.403 × 208.1 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the assignUserRole() function in all versions up to, and including, 2.2.2. This makes it possible for unauthenticated attackers to elevate their privileges to that of an employer.

Affected

ProductAffectedFixed inSource

WP Job Portal – AI-Powered Recruitment System for Company or Job Board website≤ 2.2.2–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Wordfence (CNA)4.8CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refwordfence.com/threat-intel/vulnerabilities/id/4107199d-e3c7-4379-b39d-1868de7d777b?source=cve refgist.github.com/tvnnn/9b706643c5f88989c98815be8b101e11 refplugins.trac.wordpress.org/changeset/3202327/wp-job-portal/tags/2.2.3/modules/user/controller.php?old=3187129&old_path=wp-job-portal%2Ftags%2F2.2.2%2Fmodules%2Fuser%2Fcontroller.php