Arbitrary File Upload Vulnerability in JobSearch WP Job Board Plugin

CVE-2024-8614

Summary

The JobSearch WP Job Board plugin for WordPress has a security vulnerability that permits arbitrary file uploads, stemming from insufficient file type validation in the jobsearch_wp_handle_upload() function. This flaw affects all versions up to and including 2.6.7, allowing authenticated users, including those with subscriber-level access and higher, to upload malicious files to the server. This successful exploit could pave the way for potential remote code execution, posing significant risks to the integrity and security of the affected WordPress site.

References