CVE-2024-7950: LFI/Settings Update/User Creation in WP Job Portal

The impact of CVE-2024-7950 is severe. An attacker exploiting this vulnerability can leverage Local File Inclusion (LFI) to include and execute arbitrary PHP code. This effectively bypasses access controls, allowing the attacker to read sensitive files, modify plugin settings, and create new user accounts with administrative privileges. The ability to execute arbitrary code opens the door to complete server compromise, including data exfiltration, malware installation, and denial-of-service attacks. The arbitrary settings update capability allows attackers to modify plugin configurations, potentially creating backdoors or further compromising the system. This vulnerability shares similarities with other LFI exploits where attackers leverage file inclusion to gain unauthorized access and control.

1. Reserved2024-08-19
2. Published2024-09-04
3. EPSS updated2026-04-02

The primary mitigation for CVE-2024-7950 is to immediately upgrade the WP Job Portal plugin to a patched version as soon as it becomes available. Until a patch is released, consider temporarily disabling the plugin to reduce the attack surface. As a temporary workaround, restrict file access permissions on the WordPress server to prevent the inclusion of arbitrary files. Implement a Web Application Firewall (WAF) with rules to block attempts to include files outside of designated directories. Regularly review WordPress plugin configurations and user accounts for any unauthorized changes. After upgrading, verify the fix by attempting to access restricted files via the plugin's vulnerable functions; access should be denied.

Active installs

8KKnown

Plugin rating