CVE-2024-11712 Overview
CVE-2024-11712 is a broken access control vulnerability in the WP Job Portal WordPress plugin, a recruitment system used by company and job board websites. The flaw resides in the getResumeFileDownloadById() function, which lacks a capability check before serving resume files. All versions up to and including 2.2.2 are affected. Unauthenticated attackers can request arbitrary resume identifiers and download resumes belonging to other users, exposing personal information submitted by job seekers. The issue is tracked as CWE-862 Missing Authorization and CWE-359 Exposure of Private Personal Information.
Critical Impact
Unauthenticated attackers can enumerate and download private resume files stored by the plugin, leading to disclosure of applicant personal data.
Affected Products
- WP Job Portal plugin for WordPress, versions up to and including 2.2.2
- Fixed in WP Job Portal 2.2.3
- WordPress sites operating the plugin's resume module
Discovery Timeline
- 2024-12-14 - CVE-2024-11712 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-11712
Vulnerability Analysis
The WP Job Portal plugin exposes a resume download handler routed through the plugin's resume module. The getResumeFileDownloadById() function accepts a resume identifier and returns the associated file without verifying the requesting user's identity, session, or capability. Because WordPress plugins that surface admin-ajax.php or public route endpoints must enforce their own authorization, the missing check allows any anonymous HTTP client to invoke the handler. The impact is limited to confidentiality of resume data; integrity and availability of the site are not affected.
Resume files typically contain names, contact details, work history, and identity documents. Bulk enumeration of numeric resume IDs would allow scraping of the plugin's entire resume database. Details of the fix are visible in the WordPress plugin changeset for 2.2.3.
Root Cause
The root cause is a missing capability and ownership check inside getResumeFileDownloadById(). The function trusts the supplied id parameter and streams the corresponding resume file without validating that the caller is authenticated, owns the resume, or holds a recruiter-level role. This is a textbook [CWE-862] missing authorization defect combined with [CWE-359] exposure of personal information.
Attack Vector
Exploitation requires only network access to a vulnerable WordPress site. An attacker issues an HTTP request to the plugin's resume download endpoint with an incrementing resume identifier. No authentication, user interaction, or elevated privileges are required. Proof-of-concept material is referenced in the Wordfence advisory and community GitHub Gist PoC.
No verified exploit code is reproduced here. Refer to the linked advisories for technical details of the request structure.
Detection Methods for CVE-2024-11712
Indicators of Compromise
- Unauthenticated HTTP requests to admin-ajax.php or plugin routes containing the getResumeFileDownloadById action or resume module parameters.
- Sequential or high-volume requests iterating numeric resume id values from a single source IP or user agent.
- Web server access logs showing successful (HTTP 200) resume file responses without a preceding authenticated session cookie.
Detection Strategies
- Review WordPress access logs for calls to the resume download endpoint that lack an authenticated wordpress_logged_in_* cookie.
- Correlate outbound file transfer size with request patterns to identify scraping behavior against the resume module.
- Compare installed plugin versions against 2.2.3 across managed WordPress fleets to identify vulnerable hosts.
Monitoring Recommendations
- Enable a Web Application Firewall (WAF) rule set that alerts on anonymous access to WP Job Portal resume endpoints.
- Monitor for spikes in downloads from /wp-content/uploads/ paths that host resume files.
- Alert on repeated 200-status responses to identical endpoint calls with only the id parameter changing.
How to Mitigate CVE-2024-11712
Immediate Actions Required
- Upgrade WP Job Portal to version 2.2.3 or later on all WordPress installations.
- Audit web server and plugin logs for prior unauthenticated calls to the resume download handler and estimate data exposure.
- Notify affected job seekers if log review indicates their resume files were retrieved by unauthorized sources.
Patch Information
The vendor addressed the issue in WP Job Portal 2.2.3. The plugin changeset adds a capability check inside getResumeFileDownloadById() so that only authorized users can retrieve resume files.
Workarounds
- If patching is delayed, deactivate the WP Job Portal plugin until the upgrade to 2.2.3 can be applied.
- Restrict access to the resume download endpoint at the WAF or reverse proxy layer to authenticated sessions only.
- Move stored resume files out of publicly accessible wp-content/uploads paths and serve them through an authenticated handler.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
