CVE-2024-13371: WP Job Portal <= 2.2.6 - Missing Authorization to Unauthenticated Arbitrary Email Sending
Description
The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to unauthorized arbitrary emails sending due to a missing capability check on the sendEmailToJobSeeker() function in all versions up to, and including, 2.2.6. This makes it possible for unauthenticated attackers to send arbitrary emails with arbitrary content from the sites mail server.
Classification
CVE ID: CVE-2024-13371
CVSS Base Severity: MEDIUM
CVSS Base Score: 5.3
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected Products
Vendor: wpjobportal
Product: WP Job Portal – A Complete Recruitment System for Company or Job Board website
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.05% (probability of being exploited)
EPSS Percentile: 23.8% (scored less or equal to compared to others)
EPSS Date: 2025-03-02 (when was this score calculated)
References
https://www.wordfence.com/threat-intel/vulnerabilities/id/a84a4c56-a44e-450d-91fc-024f8ddeedee?source=cvehttps://gist.github.com/g1-nhantv/31b04bc057046ecc54c3552387eb7bca
https://plugins.trac.wordpress.org/changeset/3229608/wp-job-portal/tags/2.2.7/modules/jobapply/model.php?old=3216415&old_path=wp-job-portal%2Ftags%2F2.2.6%2Fmodules%2Fjobapply%2Fmodel.php