CVE-2024-13372: WP Job Portal Auth Bypass Vulnerability

CVE-2024-13372 Overview

CVE-2024-13372 is an Insecure Direct Object Reference (IDOR) vulnerability in the WP Job Portal plugin for WordPress. The flaw affects all versions up to and including 2.2.6. Unauthenticated attackers can download user resumes without authorization by manipulating a user-controlled key passed to the getresumefiledownloadbyid() and getallresumefiles() functions. The vulnerability is tracked under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Unauthenticated attackers can enumerate and download job seekers' resumes, exposing personally identifiable information (PII) such as names, addresses, phone numbers, employment history, and educational background.

Affected Products

WP Job Portal plugin for WordPress, versions up to and including 2.2.6
Vendor: wpjobportal
Fixed in version 2.2.7

Discovery Timeline

2025-02-01 - CVE-2024-13372 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13372

Vulnerability Analysis

WP Job Portal is a recruitment plugin that enables companies and job boards to manage applications, including candidate resumes. The plugin exposes two functions, getresumefiledownloadbyid() and getallresumefiles(), that accept a user-supplied identifier to locate and return resume files. Neither function validates whether the requesting client is authenticated or authorized to access the referenced object.

An attacker who guesses or enumerates valid resume identifiers can retrieve arbitrary files owned by other users. Because the endpoints are reachable without authentication, exploitation only requires network access to the vulnerable WordPress site. The impact is limited to confidentiality of resume data; integrity and availability of the site are not directly affected.

Root Cause

The root cause is missing authorization enforcement on a direct object reference. The resume download endpoints trust the client-supplied key and resolve it to a file without verifying that the current session owns the resource or has permission to access it, which is the defining pattern of CWE-639.

Attack Vector

Exploitation occurs over the network against the plugin's resume download handlers. An attacker sends crafted requests to the WordPress endpoints that invoke getresumefiledownloadbyid() or getallresumefiles(), incrementing or brute-forcing the resume identifier parameter. Successful requests return resume files belonging to arbitrary registered users. No credentials, user interaction, or elevated privileges are required.

No verified public proof-of-concept is available. The patched code can be reviewed in the WordPress Plugin Changeset and the Wordfence Vulnerability Report.

Detection Methods for CVE-2024-13372

Indicators of Compromise

Unauthenticated HTTP requests to WP Job Portal endpoints invoking getresumefiledownloadbyid or getallresumefiles actions.
Sequential or high-volume requests iterating through numeric resume identifier parameters from a single client.
Outbound responses containing resume file attachments (PDF, DOC, DOCX) served to unauthenticated sessions.

Detection Strategies

Inspect WordPress access logs for query strings referencing the vulnerable functions and correlate against session state.
Deploy web application firewall (WAF) rules that flag repeated resume download requests without a valid authenticated cookie.
Compare downloaded resume counts against legitimate recruiter activity baselines to surface anomalous bulk retrieval.

Monitoring Recommendations

Enable verbose logging on the /wp-admin/admin-ajax.php and plugin controller routes handling resume downloads.
Alert on HTTP 200 responses with Content-Disposition: attachment headers served to requests lacking authentication cookies.
Track unique source IP addresses that request more than a defined threshold of resume identifiers within a short interval.

How to Mitigate CVE-2024-13372

Immediate Actions Required

Upgrade the WP Job Portal plugin to version 2.2.7 or later on all affected WordPress installations.
Audit web server and application logs for prior unauthenticated access to resume download endpoints.
Notify affected job seekers if evidence of resume exfiltration is discovered, in line with applicable data protection regulations.

Patch Information

The vendor addressed the issue in WP Job Portal version 2.2.7. The fix adds authorization checks to the resume download handlers in modules/resume/controller.php. Administrators can review the exact code changes in the WordPress Plugin Changeset 3229608.

Workarounds

Restrict access to the plugin's resume endpoints at the web server or WAF layer until the patch can be applied.
Disable the WP Job Portal plugin temporarily if patching is not immediately feasible and resume data is sensitive.
Rotate or invalidate previously issued resume identifiers where feasible to reduce the value of enumeration attempts.

bash

# Example WAF rule concept blocking unauthenticated resume downloads
# (adapt to your WAF syntax; requires session/cookie inspection)
SecRule REQUEST_URI "@rx (getresumefiledownloadbyid|getallresumefiles)" \
  "id:1013372,phase:1,deny,status:403,\
   chain,msg:'CVE-2024-13372 WP Job Portal IDOR attempt'"
  SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"