CVE-2024-13425: WP Job Portal <= 2.2.6 - Insecure Direct Object Reference to Authenticated (Employer+) Arbitrary Company Deletion
The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.6 via the enforcedelete() function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Employer-level access and above, to delete other users companies.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-13425?
CVE-2024-13425 is considered to have a medium severity due to its potential for unauthorized access through insecure direct object references.
How do I fix CVE-2024-13425?
To fix CVE-2024-13425, upgrade the WP Job Portal plugin to version 2.2.7 or later.
What versions of WP Job Portal are affected by CVE-2024-13425?
All versions of WP Job Portal up to and including 2.2.6 are affected by CVE-2024-13425.
What is the cause of CVE-2024-13425?
CVE-2024-13425 is caused by missing validation on a user-controlled key in the enforcedelete() function.
Is user data at risk due to CVE-2024-13425?
Yes, CVE-2024-13425 could potentially expose user data due to improper access control.