WP Job Portal <= 2.1.6 - अनधिकृत स्थानीय फ़ाइल समावेशन, मनमाना सेटिंग्स अपडेट और उपयोगकर्ता निर्माण में छूटी हुई प्राधिकरण

The impact of CVE-2024-7950 is severe. An attacker exploiting this vulnerability can leverage Local File Inclusion (LFI) to include and execute arbitrary PHP code. This effectively bypasses access controls, allowing the attacker to read sensitive files, modify plugin settings, and create new user accounts with administrative privileges. The ability to execute arbitrary code opens the door to complete server compromise, including data exfiltration, malware installation, and denial-of-service attacks. The arbitrary settings update capability allows attackers to modify plugin configurations, potentially creating backdoors or further compromising the system. This vulnerability shares similarities with other LFI exploits where attackers leverage file inclusion to gain unauthorized access and control.

Websites using the WP Job Portal plugin, particularly those running older, unpatched versions (≤2.1.6), are at significant risk. Shared hosting environments where multiple websites share the same server are particularly vulnerable, as a compromise of one site could potentially lead to the compromise of others. Sites with weak file permissions or inadequate WAF protection are also at increased risk.

• wordpress / composer / npm:

grep -r 'checkFormRequest' /var/www/html/wp-content/plugins/wp-job-portal/

• wordpress / composer / npm:

wp plugin list | grep "wp-job-portal"

• wordpress / composer / npm:

wp plugin update wp-job-portal

• generic web: Check WordPress plugin directory for updates to WP Job Portal. • generic web: Review WordPress server access logs for suspicious file inclusion attempts.

1. 2024-09-04Disclosure

   disclosure

1. आरक्षित2024-08-19
2. प्रकाशित2024-09-04
3. EPSS अद्यतन2026-04-02

The primary mitigation for CVE-2024-7950 is to immediately upgrade the WP Job Portal plugin to a patched version as soon as it becomes available. Until a patch is released, consider temporarily disabling the plugin to reduce the attack surface. As a temporary workaround, restrict file access permissions on the WordPress server to prevent the inclusion of arbitrary files. Implement a Web Application Firewall (WAF) with rules to block attempts to include files outside of designated directories. Regularly review WordPress plugin configurations and user accounts for any unauthorized changes. After upgrading, verify the fix by attempting to access restricted files via the plugin's vulnerable functions; access should be denied.

सक्रिय इंस्टॉलेशन

8Kज्ञात

प्लगइन रेटिंग