by Kastro
Paper/Archive/CVE-2024-8615

CVE-2024-8615

eyecix JobSearch WP Job Board — WP JobSearch <= 2.6.7 - Unauthenticated Arbitrary File Upload

EPSS 0.9%CVSS 10.0
critical.is priorityof 100
42
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 58.5.585 × 2011.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The JobSearch WP Job Board plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the jobsearch_location_load_excel_file_callback() function in all versions up to, and including, 2.6.7. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Affected

ProductAffectedFixed inSource
JobSearch WP Job Board≤ 2.6.7–CNA
jobsearch_wp_job_board≤ 2.6.7–CISA-ADP

Scores by source

Wordfence (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refwordfence.com/threat-intel/vulnerabilities/id/dd718d44-4921-4deb-af5a-43e5f3926914?source=cverefcodecanyon.net/item/jobsearch-wp-job-board-wordpress-plugin/21066856