CVE-2024-13371 Overview
CVE-2024-13371 affects the WP Job Portal plugin for WordPress, a recruitment system used by company career and job board websites. The vulnerability resides in the sendEmailToJobSeeker() function, which lacks a capability check. Unauthenticated attackers can invoke this function remotely to send arbitrary emails with attacker-controlled content through the site's mail server. All plugin versions up to and including 2.2.6 are affected. The issue is classified as Missing Authorization [CWE-862] and was patched in version 2.2.7. Attackers can abuse this flaw to conduct phishing campaigns, distribute malware, or damage domain sender reputation by leveraging the trusted origin of the compromised WordPress site.
Critical Impact
Unauthenticated remote attackers can send arbitrary emails from a vulnerable site's mail server, enabling phishing and brand-abuse campaigns that appear to originate from a trusted domain.
Affected Products
- WP Job Portal WordPress plugin versions 1.0.0 through 2.2.6
- WordPress sites running the WP Job Portal Recruitment System
- Any deployment that has not upgraded to WP Job Portal 2.2.7 or later
Discovery Timeline
- 2025-02-01 - CVE-2024-13371 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-13371
Vulnerability Analysis
The WP Job Portal plugin exposes a sendEmailToJobSeeker() function inside the jobapply module. The function was designed to notify job seekers on behalf of employers or the site owner. However, the function omits any WordPress capability check or nonce validation before dispatching mail. As a result, any unauthenticated visitor can reach the endpoint and supply recipient, subject, and body parameters. The WordPress mail subsystem then relays the message using the site's configured SMTP transport. Because the message leaves the legitimate domain, it inherits the site's SPF, DKIM, and DMARC alignment. This significantly increases the likelihood that phishing content is delivered to inboxes rather than filtered as spam.
Root Cause
The root cause is a missing authorization control [CWE-862] on a privileged action. The sendEmailToJobSeeker() handler in modules/jobapply/model.php did not invoke current_user_can() or verify a nonce prior to executing. The upstream patch in changeset 3229608 for tag 2.2.7 introduces the necessary access-control gating. See the WordPress Plugin Changeset for the exact code diff.
Attack Vector
An attacker sends an unauthenticated HTTP request to the WordPress AJAX or plugin endpoint that dispatches to sendEmailToJobSeeker(). The request supplies attacker-controlled recipient addresses and message content. The plugin invokes wp_mail() (or a comparable transport) and the message is sent from the site's mail server. No user interaction, session, or account is required. Proof-of-concept details are documented in the Wordfence Vulnerability Analysis and the associated GitHub Gist Code Snippet.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2024-13371
Indicators of Compromise
- Unexpected outbound email volume from the WordPress host or configured SMTP relay to unfamiliar recipient domains
- Web server access logs containing POST requests to admin-ajax.php or plugin endpoints referencing the jobapply module or a sendEmailToJobSeeker action from unauthenticated sessions
- Bounce messages, abuse complaints, or blocklist entries for the site's sending domain
- Mail queue entries with attacker-controlled subjects or body content that do not correspond to legitimate applicant activity
Detection Strategies
- Alert on WordPress AJAX requests invoking WP Job Portal actions without an authenticated session cookie
- Correlate spikes in wp_mail() invocations with source IPs that have no prior authentication history
- Monitor DMARC and SMTP relay logs for outbound messages to recipients unrelated to the site's normal audience
Monitoring Recommendations
- Ingest WordPress access logs and mail server logs into a centralized analytics platform to build a baseline of legitimate applicant email flows
- Track installed plugin versions across the WordPress estate and flag any host still running WP Job Portal 2.2.6 or earlier
- Enable SMTP rate limiting and per-source thresholds to surface abuse in near real time
How to Mitigate CVE-2024-13371
Immediate Actions Required
- Update the WP Job Portal plugin to version 2.2.7 or later on every affected WordPress site
- Rotate any SMTP credentials configured within WordPress if abuse is suspected
- Review outbound mail logs for the past 90 days and notify recipients of any confirmed phishing sent from the domain
- Submit the domain for re-evaluation with major mail providers if reputation has degraded
Patch Information
The vendor addressed the issue in WP Job Portal 2.2.7. The fix is published in WordPress.org changeset 3229608, which adds the missing authorization check to modules/jobapply/model.php. Administrators should apply the update through the WordPress plugin dashboard or by deploying the packaged release. Full diff details are available in the WordPress Plugin Changeset.
Workarounds
- Deactivate the WP Job Portal plugin until the update to 2.2.7 can be applied
- Restrict access to admin-ajax.php endpoints handling jobapply actions using web application firewall rules that require an authenticated session
- Configure SMTP rate limits and outbound recipient allowlists at the mail transport layer to contain abuse
- Enforce strict DMARC policy (p=reject) so that any downstream abuse of the domain is rejected by receiving mail servers
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
