CVE-2024-7351: Simple Job Board <= 2.12.3 - Authenticated (Editor+) PHP Object Injection
The Simple Job Board plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.3 via deserialization of untrusted input when editing job applications. This makes it possible for authenticated attackers, with Editor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-7351?
CVE-2024-7351 is classified as a high severity vulnerability due to its potential for PHP Object Injection.
How can I fix CVE-2024-7351?
To fix CVE-2024-7351, update the Simple Job Board plugin for WordPress to version 2.12.4 or higher.
Who is affected by CVE-2024-7351?
CVE-2024-7351 affects any authenticated users with Editor-level access and above using the Simple Job Board plugin up to version 2.12.3.
What type of vulnerability is CVE-2024-7351?
CVE-2024-7351 is identified as a PHP Object Injection vulnerability due to the deserialization of untrusted input.
Are there known exploits for CVE-2024-7351?
As of now, specific exploits for CVE-2024-7351 have not been publicly disclosed.