CVE-2024-43245: Privilege Escalation in eyecix JobSearch

The Improper Privilege Management flaw allows an attacker to bypass intended access controls and gain elevated privileges on the WordPress site where JobSearch is installed. This could enable them to modify user roles, install malicious plugins, access sensitive data, or even take complete control of the website. The potential blast radius is significant, as a successful exploit could compromise the entire WordPress installation and any connected databases or services. This is particularly concerning for sites using JobSearch for sensitive data handling or user authentication.

1. Reserved2024-08-09
2. Published2024-08-19
3. Modified2024-08-20
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-43245 is to immediately upgrade to eyecix JobSearch version 2.3.5 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily restricting access to the JobSearch plugin's administrative interface. While not a complete solution, this can limit the attacker's ability to exploit the vulnerability. Monitor WordPress access logs for suspicious activity, particularly attempts to modify user roles or install plugins from untrusted sources. Implement a Web Application Firewall (WAF) with rules to block attempts to exploit privilege escalation vulnerabilities.