CVE-2024-13428: WP Job Portal <= 2.2.6 - Insecure Direct Object Reference to Unauthenticated Company Logo Deletion
The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.6 via the deleteCompanyLogo() due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to delete arbitrary company logos.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-13428?
CVE-2024-13428 has a medium severity level due to the potential for unauthorized access and manipulation of company logos.
How do I fix CVE-2024-13428?
To fix CVE-2024-13428, update the WP Job Portal plugin to version 2.2.7 or later.
What versions of WP Job Portal are affected by CVE-2024-13428?
CVE-2024-13428 affects all versions of the WP Job Portal plugin up to and including version 2.2.6.
Is user authentication affected by CVE-2024-13428?
Yes, CVE-2024-13428 can allow attackers to exploit the insecure direct object reference regardless of user authentication.
Can CVE-2024-13428 lead to data exposure?
Yes, CVE-2024-13428 could potentially lead to data exposure by allowing attackers to delete or manipulate company logos without proper authorization.