Overview

WordPress is vulnerable to critical vulnerabilities. Exploitation of these vulnerabilities may allow an unauthenticated attacker to execute code remotely.

Description

WordPress plugins wp-jobsearch, and mfolio-lite are affected by the vulnerabilities tracked as CVE-2024-8615, and CVE-2024-9307 with CVSS scores of 10 and 9.9 respectively. The plugins are vulnerable due to missing file type validation in the jobsearch_location_load_excel_file_callback() function, and a missing capability check. The vulnerabilities allow attackers to achieve remote code execution on affected systems.

Impact

Successful exploitation of these vulnerabilities may allow the attackers to take control of the affected system.

Solution

WordPress has released security patches for these vulnerabilities. Users and administrators are encouraged to apply necessary updates.

References

• 1. https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-jobsearch/wp-jobsearch-267-unauthenticated-arbitrary-file-upload
• 2. https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/mfolio-lite/mfolio-lite-121-missing-authorization-to-authenticated-author-file-upload-via-exe-and-svg-files