CVEvulnerability

CVE-2024-12131

4.3 MEDIUM Published 2025-01-07 Modified 2026-06-17 Official page ↗

Status: Analyzed
Published: 2025-01-07
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses: CWE-639

Description

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.5 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to submit resumes for other applicants when applying for jobs.

Affected configurations

• wpjobportal wp job portal (< 2.2.6)

Weakness · CWE (1)

CWE-639 Authorization Bypass Through User-Controlled Key weakness

References

https://plugins.trac.wordpress.org/browser/wp-job-portal/tags/2.2.6/modules/jobapply/model.php?rev=3216415 Product
https://www.wordfence.com/threat-intel/vulnerabilities/id/b4772ab0-41cd-4b35-bda9-d72e0fd7b7a5?source=cve Third Party Advisory

CVE-2024-12131

Description

Affected configurations

Related

Weakness · CWE (1)

References