Authentication Bypass Vulnerability in JobSearch WP Job Board Plugin for WordPress

CVE-2024-11917

What is CVE-2024-11917?

The JobSearch WP Job Board plugin for WordPress is susceptible to an authentication bypass, allowing unauthenticated users to gain access under certain conditions. This vulnerability arises from improper configurations within the callback functions, particularly 'jobsearch_xing_response_data_callback', 'set_access_tokens', and 'google_callback'. Attackers can exploit this flaw to log in as the first connected user from both Xing and Google platforms if proper logout procedures are not followed within a thirty-day window. A partial patch was implemented in version 2.8.4, but vulnerabilities remain in earlier versions.

References