CVE-2024-0593: Simple Job Board Auth Bypass Vulnerability

CVE-2024-0593 Overview

The Simple Job Board plugin for WordPress contains a missing authorization vulnerability in the fetch_quick_job() AJAX handler. All versions up to and including 2.10.8 fail to verify caller privileges before returning post content. Unauthenticated attackers can retrieve arbitrary posts, including password-protected and private entries that may contain sensitive business or applicant data.

The issue is tracked as CWE-862 Missing Authorization. The vendor presstigers patched the plugin via changeset 3038476 on the WordPress plugin repository.

Critical Impact
Unauthenticated remote attackers can read protected and private WordPress posts served through the fetch_quick_job() endpoint without any user interaction.

Affected Products

Presstigers Simple Job Board plugin for WordPress, all versions through 2.10.8
WordPress sites exposing the plugin's admin-ajax fetch_quick_job action
Job listing deployments relying on password-protected or private post visibility

Discovery Timeline

2024-02-21 - CVE-2024-0593 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-0593

Vulnerability Analysis

The Simple Job Board plugin registers a WordPress AJAX action that resolves to the fetch_quick_job() function inside class-simple-job-board-ajax.php. The handler accepts a post identifier from the request and returns the corresponding post content. It does not confirm that the requester has permission to view the target post.

Because WordPress registers wp_ajax_nopriv_* handlers for unauthenticated visitors, the endpoint is reachable without a session. An attacker supplies any numeric post ID and receives the underlying content, bypassing the visibility rules that WordPress normally applies to private and password post statuses.

This is an information disclosure issue with no impact to integrity or availability, but exposed data can include unpublished drafts, internal announcements, and applicant records stored as protected posts.

Root Cause

The root cause is the absence of a capability check and post-status filter in fetch_quick_job(). The function reads the post directly rather than calling helpers such as current_user_can() or honoring get_post_status() restrictions. Any request supplying the AJAX action parameter reaches the data-fetch path.

Attack Vector

Exploitation requires only network access to the vulnerable site's admin-ajax.php endpoint. The attacker issues a crafted POST or GET request specifying the fetch_quick_job action and a target post ID. Enumeration of post IDs yields the full set of protected content. No credentials, cookies, or user interaction are required.

No public proof-of-concept or exploit-database entry is referenced in the advisory data, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-0593

Indicators of Compromise

Unauthenticated POST or GET requests to /wp-admin/admin-ajax.php containing action=fetch_quick_job
High-volume sequential requests iterating numeric post_id values from a single source
HTTP 200 responses returning content for posts whose status is private or password

Detection Strategies

Inspect web server and WAF logs for the fetch_quick_job action originating from unauthenticated sessions
Correlate spikes in admin-ajax.php traffic with the Simple Job Board plugin being installed at versions <= 2.10.8
Alert when protected post content appears in outbound responses to non-authenticated clients

Monitoring Recommendations

Enable request logging for admin-ajax.php with full query string and referrer capture
Track the installed version of simple-job-board across managed WordPress sites
Baseline normal AJAX action frequency and alert on deviations tied to plugin endpoints

How to Mitigate CVE-2024-0593

Immediate Actions Required

Update the Simple Job Board plugin to a version newer than 2.10.8 that includes changeset 3038476
Audit WordPress posts with private or password status for potential prior exposure
Restrict access to admin-ajax.php from untrusted networks where feasible

Patch Information

The vendor released a fix in the plugin trunk via WordPress Plugin Change Log changeset 3038476. The update adds authorization enforcement in fetch_quick_job(). Additional context is available in the Wordfence Vulnerability Report.

Workarounds

Deploy a WAF rule blocking unauthenticated requests where action=fetch_quick_job is present
Temporarily deactivate the Simple Job Board plugin until the patched version is installed
Move sensitive content out of WordPress posts accessible through the vulnerable endpoint

bash

# Example ModSecurity rule to block unauthenticated fetch_quick_job requests
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
    "chain,id:1000593,phase:2,deny,status:403,msg:'Block CVE-2024-0593 fetch_quick_job'"
    SecRule ARGS:action "@streq fetch_quick_job" \
        "chain"
        SecRule &REQUEST_COOKIES:wordpress_logged_in_ "@eq 0"