CVE-2024-7351 Overview
CVE-2024-7351 is a PHP Object Injection vulnerability in the Simple Job Board plugin for WordPress, affecting all versions up to and including 2.12.3. The flaw stems from unsafe deserialization of untrusted input during the editing of job applications. Authenticated attackers with Editor-level access or above can inject a crafted PHP object into the application. While no Property-Oriented Programming (POP) chain exists in the plugin itself, a chain introduced by another installed plugin or theme could enable arbitrary file deletion, sensitive data disclosure, or code execution. The vulnerability is tracked under CWE-502: Deserialization of Untrusted Data.
Critical Impact
Authenticated Editor-level users can inject PHP objects that, combined with a POP chain from another plugin or theme, can lead to arbitrary file deletion, data exfiltration, or remote code execution.
Affected Products
- Presstigers Simple Job Board plugin for WordPress
- All versions up to and including 2.12.3
- WordPress installations exposing the job application editing workflow to Editor or higher roles
Discovery Timeline
- 2024-08-24 - CVE-2024-7351 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in the NVD database
Technical Details for CVE-2024-7351
Vulnerability Analysis
The Simple Job Board plugin exposes an application editing workflow that passes attacker-controllable input into a PHP deserialization routine. When an authenticated Editor or higher-privileged user submits or edits a job application containing a crafted serialized payload, the plugin reconstructs PHP objects from that untrusted data. This creates the conditions for PHP Object Injection, classified under CWE-502.
The plugin does not ship any usable POP chain, so the vulnerability is not directly exploitable for code execution in isolation. However, WordPress environments commonly load additional plugins and themes, and any component that defines a class with dangerous magic methods (__destruct, __wakeup, __toString) can be chained to the injected object. In practical terms, an attacker's payload triggers method calls on classes already loaded by WordPress or another plugin, expanding impact to file deletion, arbitrary file read, or code execution.
Root Cause
The root cause is the use of PHP's unserialize() (or equivalent) on user-supplied data from the job application editing endpoint without validating or filtering the input to a safe type. Any string reaching the deserializer is trusted to represent well-formed application data, allowing arbitrary class instantiation.
Attack Vector
Exploitation requires network access to the WordPress administrative interface and valid credentials for an Editor or higher account. The attacker submits a serialized PHP object as part of the job application edit request. When the plugin processes the record, deserialization instantiates the attacker's object graph. If a gadget chain exists on the target, the chain executes during object destruction or property access, resulting in the follow-on impact.
No public proof-of-concept, exploit database entry, or CISA KEV listing is associated with this CVE at the time of writing. Technical details are available in the Wordfence Vulnerability Report and the WordPress Plugin Changeset that introduced the fix.
Detection Methods for CVE-2024-7351
Indicators of Compromise
- Serialized PHP payloads (strings starting with O: or a: followed by a class or array descriptor) submitted to Simple Job Board application editing endpoints.
- Unexpected file deletions, PHP error log entries referencing __destruct or __wakeup in plugin or theme classes shortly after job application activity.
- New or modified files under wp-content/uploads/ or the plugin directory correlating with Editor account activity.
Detection Strategies
- Inspect web server and PHP-FPM logs for POST requests to Simple Job Board admin endpoints containing serialized object markers.
- Audit WordPress user roles and recent Editor-level actions in the wp_posts and application tables for anomalous edits.
- Compare deployed plugin files against the vendor's 2.12.4 release to detect tampering or unpatched installations.
Monitoring Recommendations
- Alert on any HTTP request body containing O: or a: object markers reaching WordPress admin URLs.
- Track privilege changes and new Editor or Administrator accounts across managed WordPress sites.
- Forward WordPress and web server logs to a centralized platform for correlation and retention.
How to Mitigate CVE-2024-7351
Immediate Actions Required
- Upgrade the Simple Job Board plugin to the version that includes the fix committed in changeset 3138348 (any release after 2.12.3).
- Review all Editor and Administrator accounts and rotate credentials for any that may have been compromised.
- Audit installed plugins and themes for classes with dangerous magic methods that could act as POP gadgets.
Patch Information
Presstigers addressed the vulnerability in the Simple Job Board plugin release following version 2.12.3. The fix is visible in the WordPress plugin changeset, which removes the unsafe deserialization path in the job application editing logic. Site owners should update through the WordPress plugin management console and verify the installed version reports higher than 2.12.3.
Workarounds
- Restrict Editor and higher role assignments to trusted administrators until the plugin is updated.
- Deploy a Web Application Firewall (WAF) rule to block requests containing serialized PHP object markers to Simple Job Board endpoints.
- Temporarily deactivate the Simple Job Board plugin if patching is not immediately possible.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
