CVE-2024-13371: WP Job Portal <= 2.2.6 - Missing Authorization to Unauthenticated Arbitrary Email Sending
The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to unauthorized arbitrary emails sending due to a missing capability check on the sendEmailToJobSeeker() function in all versions up to, and including, 2.2.6. This makes it possible for unauthenticated attackers to send arbitrary emails with arbitrary content from the sites mail server.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-13371?
CVE-2024-13371 is considered a high severity vulnerability due to its potential for unauthorized email sending.
How do I fix CVE-2024-13371?
To fix CVE-2024-13371, upgrade the WP Job Portal plugin to version 2.2.7 or later.
What versions are affected by CVE-2024-13371?
CVE-2024-13371 affects all versions of the WP Job Portal plugin up to and including version 2.2.6.
What does CVE-2024-13371 exploit?
CVE-2024-13371 exploits a missing capability check in the sendEmailToJobSeeker() function.
Who is impacted by CVE-2024-13371?
Any website using the WP Job Portal plugin up to version 2.2.6 is impacted by CVE-2024-13371, enabling unauthorized email sending.