Critical · published February 12, 2025
🚨 An unauthenticated user can become an admin just by filling out a form! The WP Job Board Pro plugin for WordPress has a mind-blowingly simple privilege escalation flaw that affects all versions up to 2.3.16. 🔥 Think of it like a job application process where anyone can simply write 'CEO' on their application and get hired on the spot — no background check or verification needed! This is exactly the danger posed by this plugin's registration process. If exploited, an attacker could register as an administrator and gain full control of your WordPress site, allowing them to modify settings, add malicious content, or even lock you out completely. This isn't just a prank; it could lead to devastating data loss and reputational damage.
Think of it like a job application process where anyone can simply write 'CEO' on their application and get hired on the spot — no background check or verification needed! This is exactly the danger posed by this plugin's registration process. This vulnerability arises because the WP Job Board Pro plugin allows users to specify the 'role' field during registration, which means an unauthenticated attacker can register with elevated admin privileges without any verification.
If exploited, an attacker could register as an administrator and gain full control of your WordPress site, allowing them to modify settings, add malicious content, or even lock you out completely. This isn't just a prank; it could lead to devastating data loss and reputational damage. Patch your WP Job Board Pro plugin immediately to version 2.3.17 or later. If you're running an older version (1.2.85 is the earliest confirmed patched version), upgrade to ensure you're safe from this critical flaw. Regularly audit user roles and registrations to catch any potential misuse. You've got this! Follow these steps and you'll bolster your site’s security in no time! 🛡️