CVE-2024-13873: WP Job Portal <= 2.2.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) User Photo Disconnection
The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.8 via the deleteUserPhoto() function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to remove profile photos from users accounts. Please note that this does not officially delete the file.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-13873?
CVE-2024-13873 is considered a moderate severity vulnerability due to the potential for unauthorized access to user photos.
How do I fix CVE-2024-13873?
To fix CVE-2024-13873, update the WP Job Portal plugin to version 2.2.9 or later.
What does CVE-2024-13873 affect?
CVE-2024-13873 affects all versions of the WP Job Portal plugin for WordPress up to and including version 2.2.8.
What is the primary vulnerability type of CVE-2024-13873?
The primary vulnerability type of CVE-2024-13873 is Insecure Direct Object Reference due to missing validation.
Is user interaction required for CVE-2024-13873?
No, CVE-2024-13873 does not require user interaction to exploit the vulnerability.