CVE-2024-13371 – WordPress Job Portal – Mail Server Email Sending Remote Code Execution

The following table lists the changes that have been made to the
CVE-2024-13371 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution
of a vulnerability, and for identifying the most recent changes that may
impact the vulnerability’s severity, exploitability, or other characteristics.

  • New CVE Received
    by [email protected]

    Feb. 01, 2025

    Action Type Old Value New Value
    Added Description The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to unauthorized arbitrary emails sending due to a missing capability check on the sendEmailToJobSeeker() function in all versions up to, and including, 2.2.6. This makes it possible for unauthenticated attackers to send arbitrary emails with arbitrary content from the sites mail server.
    Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
    Added CWE CWE-862
    Added Reference https://gist.github.com/g1-nhantv/31b04bc057046ecc54c3552387eb7bca
    Added Reference https://plugins.trac.wordpress.org/changeset/3229608/wp-job-portal/tags/2.2.7/modules/jobapply/model.php?old=3216415&old_path=wp-job-portal%2Ftags%2F2.2.6%2Fmodules%2Fjobapply%2Fmodel.php
    Added Reference https://www.wordfence.com/threat-intel/vulnerabilities/id/a84a4c56-a44e-450d-91fc-024f8ddeedee?source=cve
Share the Post:

Related Posts