WordPress Plugin Vulnerabilities

Simple Job Board < 2.12.6 - Unauthenticated Resumes Download

Description

The plugin does not prevent uploaded files from being listed, allowing unauthenticated users to access and download uploaded resumes

Proof of Concept

Affects Plugins

Plugin icon
simple-job-board
Fixed in 2.12.6

References

CVE
CVE-2024-7762
URL
https://research.cleantalk.org/cve-2024-7762/

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
3.7 (low)

Miscellaneous

Original Researcher
Dmitrii Ignatyev
Submitter
Dmitrii Ignatyev
Submitter website
https://www.linkedin.com/in/dmitriy-ignatyev-8a9189267/
Verified
Yes
WPVDB ID
26403e72-c927-4649-b789-694a10ad0492

Timeline

Publicly Published
2024-07-04 (about 1 year ago)
Added
2024-09-13 (about 1 year ago)
Last Updated
2024-09-13 (about 1 year ago)

Other

Published
Title
Published
2023-04-19
Title
Active Directory Integration / LDAP Integration < 4.1.1 - Unauthenticated Data Disclosure
Published
2025-06-19
Title
ProfileGrid < 5.9.5.3 - Authenticated (Subscriber+) Full Path Disclosure
Published
2025-09-05
Title
Ninja Charts < 3.3.6 - Unauthenticated Information Exposure
Published
2023-07-19
Title
Essential Addons For Elementor < 5.8.2 - Unauthenticated MailChimp API Key Disclosure
Published
2022-11-10
Title
Clerk < 4.0.0 - Authentication Bypass and API Keys Disclosure