CVE-2024-13428 Overview
CVE-2024-13428 affects the WP Job Portal plugin for WordPress, a recruitment system used by company and job board websites. The flaw is an Insecure Direct Object Reference (IDOR) in the deleteCompanyLogo() function. All versions up to and including 2.2.6 fail to validate a user-controlled key before deleting a company logo. Unauthenticated attackers can send crafted requests to remove arbitrary company logos from affected sites. The issue is tracked under CWE-639: Authorization Bypass Through User-Controlled Key. Vendor fix arrived in version 2.2.7.
Critical Impact
Unauthenticated attackers can delete arbitrary company logos on affected WordPress sites, degrading site integrity and disrupting recruiter branding without any credentials.
Affected Products
- WP Job Portal plugin for WordPress, versions up to and including 2.2.6
- Vendor: wpjobportal
- Fixed in WP Job Portal 2.2.7
Discovery Timeline
- 2025-02-01 - CVE-2024-13428 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-13428
Vulnerability Analysis
The vulnerability resides in the deleteCompanyLogo() method inside the plugin's modules/company/model.php file. The function acts on an identifier supplied by the requester but does not verify that the requester owns or is authorized to modify the referenced company record. Because the endpoint is reachable without authentication, any remote user can invoke the deletion routine against any company logo stored by the plugin.
The impact is limited to integrity of the logo asset. Data confidentiality and site availability are not directly affected, but repeated abuse can disrupt the visual presentation of job listings and recruiter branding at scale. Attackers can enumerate company identifiers sequentially and issue deletion requests to remove logos across a target site.
Root Cause
The root cause is missing authorization on a user-controlled key. The deleteCompanyLogo() handler trusts the identifier submitted in the request and performs the deletion without checking session state, capability, ownership, or a nonce. This is a textbook CWE-639 pattern where the application exposes internal object references directly to the client.
Attack Vector
Exploitation requires only network access to the target WordPress site. The attacker sends an HTTP request to the plugin's AJAX or REST endpoint that dispatches deleteCompanyLogo(), supplying a company identifier as a parameter. No authentication, user interaction, or elevated privilege is required. Technical details of the vulnerable code path and the corrective changeset are available in the WordPress Plugin Changeset for 2.2.7 and the Wordfence Vulnerability Report.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2024-13428
Indicators of Compromise
- Unauthenticated POST or GET requests to WP Job Portal endpoints containing deleteCompanyLogo or the task=deletecompanylogo action parameter.
- Unexpected removals of logo records or missing image files under the plugin's uploads directory for company assets.
- Web server logs showing sequential enumeration of companyid values from a single remote source.
Detection Strategies
- Inspect WordPress access logs for requests to admin-ajax.php or plugin controllers where the action or task parameter references company logo deletion by unauthenticated sessions.
- Correlate deletion events in the wp_job_portal company tables with the originating HTTP request to identify unauthorized modifications.
- Deploy a Web Application Firewall (WAF) rule that blocks deleteCompanyLogo invocations from requests lacking a valid administrator session cookie.
Monitoring Recommendations
- Alert on spikes in 200-status responses to WP Job Portal endpoints originating from a single IP address.
- Monitor filesystem changes in the WordPress uploads directory used by the plugin for unexpected image deletions.
- Track WP Job Portal plugin version across managed WordPress installations and flag any host still running 2.2.6 or earlier.
How to Mitigate CVE-2024-13428
Immediate Actions Required
- Upgrade WP Job Portal to version 2.2.7 or later on all WordPress instances where the plugin is installed.
- Audit the plugin's company records and restore any logos removed since January 2025 from backups if unauthorized deletions are found.
- Restrict access to /wp-admin/admin-ajax.php at the WAF layer for known WP Job Portal actions until patching is complete.
Patch Information
The vendor addressed the issue in WP Job Portal 2.2.7. The corrective code changes are visible in the WordPress Plugin Changeset 3229608, which adds authorization checks around the deleteCompanyLogo() handler. Site owners should apply the update through the WordPress plugins dashboard or via WP-CLI.
Workarounds
- Deactivate the WP Job Portal plugin until the patched release can be installed if updating immediately is not possible.
- Add a WAF rule that denies requests where the task or action parameter equals deletecompanylogo and no authenticated administrator cookie is present.
- Restrict access to WP Job Portal endpoints by source IP where the plugin is only used by internal recruiters.
# Update WP Job Portal to the patched version using WP-CLI
wp plugin update wp-job-portal --version=2.2.7
# Verify the installed version
wp plugin get wp-job-portal --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
