PHP Object Injection Vulnerability in Simple Job Board Plugin for WordPress
CVE-2024-1813

9.8CRITICAL

Key Information:

Vendor
Wordpress
Status
Simple Job Board
Vendor
CVE Published:
9 April 2024

Summary

The Simple Job Board plugin for WordPress is susceptible to a PHP Object Injection vulnerability in job_board_applicant_list_columns_value function due to the deserialization of untrusted input. This issue exists in all versions up to and including 2.11.0. Attackers without authentication could exploit this vulnerability to inject PHP Objects. If a chain of PHP Object Injection is established through other plugins or themes, this could lead to threats such as deletion of arbitrary files, unauthorized data retrieval, or the execution of malicious code upon accessing job applications.

Affected Version(s)

Simple Job Board * <= 2.11.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Francesco Carlucci
.