Vulnerabilities in WP Job Portal Plugin Could Allow Attacks

CVE-2024-7950

Summary

The WP Job Portal plugin for WordPress is susceptible to Local File Inclusion vulnerabilities that allow unauthorized attackers to include and execute arbitrary files on the server. This is achieved through several functions invoked by the 'checkFormRequest' function, making it possible to execute PHP code within those files. Additionally, the vulnerability facilitates bypassing of access controls, exposing sensitive data, and arbitrary settings updates, including the creation of user accounts with default Administrator roles, even when user registration is disabled. This poses significant risks for WordPress installations utilizing the affected plugin versions.

References