WordPress Plugin Vulnerabilities

JobSearch WP Job Board < 1.8.2 - Subscriber+ Add/Update Schedule Calls

Description

The jobsearch_add_job_import_schedule_call and jobsearch_update_job_import_schedule_call AJAx action o the plugin, available to any authenticated user do not have authorisation and CSRF check sin place, allowing users with a role as low as subscriber to call them

Affects Plugins

Fixed in 1.8.2

References

Classification

Type
ACCESS CONTROLS
CWE

Miscellaneous

Original Researcher
Jerome Bruandet
Verified
Yes

Timeline

Publicly Published
2021-10-05 (about 2 years ago)
Added
2021-10-05 (about 2 years ago)
Last Updated
2023-06-08 (about 11 months ago)

Other