CVE-2024-13429: WP Job Portal <= 2.2.6 - Insecure Direct Object Reference to Authenticated (Employer+) Arbitrary Job Deletion
The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.6 via the 'jobenforcedelete' due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with employer-level access and above, to delete arbitrary
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-13429?
CVE-2024-13429 is considered a critical vulnerability due to the potential for unauthorized access to sensitive data.
How do I fix CVE-2024-13429?
To fix CVE-2024-13429, upgrade the WP Job Portal plugin to version 2.2.7 or later.
What versions of WP Job Portal are affected by CVE-2024-13429?
All versions of WP Job Portal up to and including version 2.2.6 are affected by CVE-2024-13429.
What are the consequences of CVE-2024-13429 exploitation?
Exploitation of CVE-2024-13429 can lead to unauthorized deletion of job postings due to insecure direct object references.
Is there a patch for CVE-2024-13429?
Yes, a patch is available in version 2.2.7 of the WP Job Portal plugin.