CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The WP Job Board Pro plugin for WordPress is vulnerable to privilege escalation in all versions up to 2.3.16. This is due to the plugin allowing a user to supply the 'role' field when registering. This makes it possible for unauthenticated attackers to register as an administrator on vulnerable sites. Please note that this may have been patched sooner, however, the oldest available version for us to confirm this is patched in was 1.2.85.
Explanation of Vulnerability in Simple Terms
WP Job Board Pro versions before 1.2.85 contain an improper access control vulnerability that allows unauthenticated attackers to read, modify, or delete data on affected sites. The vulnerability requires no user interaction and can be exploited remotely over the network. All versions from 0 onwards through 1.2.84 are affected.
What an attacker can do
Read, modify, or delete site data without logging in.
Potential impact on your site
Attackers can compromise job listings, user data, and site integrity without any credentials.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
