CVE-2024-55993: Job Board Manager Auth Bypass Vulnerability

CVE-2024-55993 Overview

CVE-2024-55993 is a missing authorization vulnerability in the PickPlugins Job Board Manager plugin for WordPress. The flaw affects all versions of job-board-manager up to and including 2.1.61. The plugin exposes functionality that relies on incorrectly configured access control security levels, allowing unauthenticated network requests to reach protected actions. The weakness is categorized under CWE-862: Missing Authorization and impacts availability of the affected WordPress site.

Critical Impact
Unauthenticated attackers can invoke restricted plugin functionality over the network, degrading availability of the WordPress installation.

Affected Products

PickPlugins Job Board Manager (job-board-manager) versions through 2.1.61
WordPress sites running the plugin with default access control configuration
Any WordPress deployment where the plugin endpoints are reachable over the network

Discovery Timeline

2024-12-16 - CVE-2024-55993 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-55993

Vulnerability Analysis

The Job Board Manager plugin exposes one or more actions that fail to enforce a capability or nonce check before executing sensitive operations. Because access control checks are missing or misconfigured, requests that should require an authenticated privileged user are processed for any caller. The vulnerability requires no user interaction and no prior authentication. Impact is limited to availability, meaning an attacker can disrupt plugin-controlled data or workflows but cannot directly read or modify confidential content through this flaw alone.

Root Cause

The root cause is a missing authorization check within plugin action handlers. WordPress plugins typically gate privileged endpoints with current_user_can() capability checks and check_ajax_referer() nonce validation. In job-board-manager versions up to 2.1.61, these gates are absent or improperly configured on at least one handler. This falls under the broken access control class described in CWE-862.

Attack Vector

An attacker sends a crafted HTTP request over the network to the vulnerable plugin endpoint, typically admin-ajax.php with the plugin action parameter. Because the endpoint does not verify caller identity or capability, the request is executed. See the Patchstack advisory for endpoint-level detail. No proof-of-concept is publicly indexed at time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-55993

Indicators of Compromise

Unauthenticated POST or GET requests to wp-admin/admin-ajax.php referencing Job Board Manager plugin actions.
Unexpected modifications, deletions, or state changes in job listings, applications, or plugin-managed options.
Anomalous request rates from single source IPs targeting job-board-manager endpoints.

Detection Strategies

Inventory WordPress installations and identify sites running job-board-manager at version 2.1.61 or earlier.
Review web server access logs for calls to plugin AJAX or REST routes originating from unauthenticated sessions.
Correlate plugin-related actions in the WordPress audit trail with the absence of a corresponding authenticated admin session.

Monitoring Recommendations

Enable a WordPress audit logging plugin to record all administrative and plugin-level actions with source IP context.
Forward web server and application logs to a centralized SIEM for anomaly detection on plugin endpoints.
Alert on spikes in admin-ajax.php requests referencing job board actions from external IP ranges.

How to Mitigate CVE-2024-55993

Immediate Actions Required

Update job-board-manager to a version later than 2.1.61 once released by PickPlugins; monitor the Patchstack advisory for fix availability.
If no patched version is available, deactivate and remove the plugin from production sites.
Restrict access to wp-admin/admin-ajax.php for unauthenticated requests where feasible.

Patch Information

Refer to the Patchstack vulnerability record for the current patched version and vendor guidance. The advisory covers all versions through 2.1.61. Confirm the installed version after upgrade using the WordPress plugin management screen.

Workarounds

Apply a Web Application Firewall (WAF) rule blocking unauthenticated requests to Job Board Manager plugin actions.
Enforce IP allow-listing on wp-admin paths for administrative networks only.
Disable the plugin until an official fix is confirmed.

bash

# Example WAF/nginx rule: block unauthenticated calls to plugin AJAX actions
location = /wp-admin/admin-ajax.php {
    if ($arg_action ~* "^job_board_manager_") {
        # allow only requests carrying a valid WordPress logged-in cookie
        if ($http_cookie !~* "wordpress_logged_in_") {
            return 403;
        }
    }
}