CVE-2024-13873CWE-639

WP Job Portal <= 2.2.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) User Photo Disconnection

Medium · published February 22, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
24.5
In the wild
Unconfirmed
What it is

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.8 via the deleteUserPhoto() function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to remove profile photos from users accounts. Please note that this does not officially delete the file.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00327 · 24.5th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2025-02-22T03:20Z
EPSS history
Timeline
  • 22 FEB 03:20Z
    WP Job Portal <= 2.2.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) User Photo Disconnection
    cvelistv5