CVE-2024-8615
Last modified
CVE-2024-8615 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. The JobSearch WP Job Board plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the jobsearch_location_load_excel_file_callback() function in all versions up to, and including, 2.6.7. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.. EPSS estimates a 0.83% chance of exploitation in the next 30 days.
Description
The JobSearch WP Job Board plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the jobsearch_location_load_excel_file_callback() function in all versions up to, and including, 2.6.7. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Eyecix | Jobsearch Wp Job Board | < 2.6.8 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-8615?
How severe is CVE-2024-8615?
How do I fix CVE-2024-8615?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-8609Insertion of Sensitive Information into Log File vulnerabili…7.5
- CVE-2024-8610A vulnerability classified as problematic has been found in …5.4
- CVE-2024-8611A vulnerability classified as critical was found in itsource…9.8
- CVE-2024-8612A flaw was found in QEMU, in the virtio-scsi, virtio-blk, an…3.8
- CVE-2024-8613A vulnerability in gaizhenbiao/chuanhuchatgpt version 202408…8.8
- CVE-2024-8614The JobSearch WP Job Board plugin for WordPress is vulnerabl…8.8
- CVE-2024-8616In h2oai/h2o-3 version 3.46.0, the `/99/Models/{name}/json` …8.2
- CVE-2024-8617The Quiz Maker WordPress plugin before 6.5.9.9 does not sani…4.8
- CVE-2024-8618The Page Builder: Pagelayer WordPress plugin before 1.9.0 d…4.8
- CVE-2024-8619The Ajax Search Lite WordPress plugin before 4.12.3 does no…4.8
- CVE-2024-8620The MapPress Maps for WordPress plugin before 2.93 does not …4.8
- CVE-2024-8621The Daily Prayer Time plugin for WordPress is vulnerable to …6.5
Are you affected by CVE-2024-8615?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST