CVE-2024-7351

The Simple Job Board plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.3 via deserialization of untrusted input when editing job applications. This makes it possible for authenticated attackers, with Editor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

• CWE-502
• CWE-502

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3138348%40simple-job-board%2Ftrunk&old=3113171%40simple-job-board%2Ftrunk&sfp_email=&sfph_mail=#file12Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/ba6312b9-1b66-4b4f-a78d-515fa4aab63b?source=cveThird Party Advisory

Published

Aug 24, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-7345Local ABL Client bypass of the required PASOE security check…9.6
• CVE-2024-7346Host name validation for TLS certificates is bypassed when t…4.8
• CVE-2024-7347NGINX Open Source and NGINX Plus have a vulnerability in the…4.7
• CVE-2024-7348Time-of-check Time-of-use (TOCTOU) race condition in pg_dump…7.5
• CVE-2024-7349The LifterLMS – WP LMS for eLearning, Online Courses, & Quiz…7.2
• CVE-2024-7350The Appointment Booking Calendar Plugin and Online Schedulin…9.8
• CVE-2024-7352PDF-XChange Editor PDF File Parsing Out-Of-Bounds Write Remo…7.8
• CVE-2024-7353The Accept Stripe Payments plugin for WordPress is vulnerabl…5.4
• CVE-2024-7354The Ninja Forms WordPress plugin before 3.8.11 does not esc…6.1
• CVE-2024-7355The Organization chart plugin for WordPress is vulnerable to…5.4
• CVE-2024-7356The Zephyr Project Manager plugin for WordPress is vulnerabl…5.4
• CVE-2024-7357** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in…9.8