Arbitrary File Upload Vulnerability in JobSearch WP Job Board Plugin
CVE-2024-8614
8.8HIGH
Key Information
- Vendor
- JobSearch
- Status
- Jobsearch WP Job Board
- Vendor
- CVE Published:
- 6 November 2024
Summary
The JobSearch WP Job Board plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the jobsearch_wp_handle_upload() function in all versions up to, and including, 2.6.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS V3.1
Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published.
Collectors
NVD Database