CVE-2024-7950: WP Job Portal RCE Vulnerability

CVE-2024-7950 Overview

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress contains critical vulnerabilities including Local File Inclusion (LFI), Arbitrary Settings Update, and unauthorized User Creation in all versions up to, and including, 2.1.6. These vulnerabilities exist in several functions called by the checkFormRequest function, allowing unauthenticated attackers to include and execute arbitrary files on the server.

Critical Impact
Unauthenticated attackers can achieve remote code execution, bypass access controls, obtain sensitive data, modify arbitrary plugin settings, and create administrator accounts even when user registration is disabled.

Affected Products

WP Job Portal WordPress plugin versions up to and including 2.1.6
WordPress installations running vulnerable versions of WP Job Portal
Wpjobportal Wp Job Portal

Discovery Timeline

September 4, 2024 - CVE-2024-7950 published to NVD
October 4, 2024 - Last updated in NVD database

Technical Details for CVE-2024-7950

Vulnerability Analysis

This vulnerability chain combines three distinct security flaws that work together to enable complete site compromise. The Local File Inclusion vulnerability allows attackers to include and execute arbitrary PHP files on the server, which can be leveraged to run malicious code. The Arbitrary Settings Update flaw permits unauthenticated modification of plugin configuration options, potentially disabling security features or altering critical functionality. The User Creation bypass enables attackers to register new accounts with Administrator privileges, even when user registration has been explicitly disabled by site administrators.

The vulnerability is particularly dangerous because it requires no authentication to exploit. Attackers can leverage these flaws to upload malicious content disguised as images or other "safe" file types, then include and execute them through the LFI vulnerability.

Root Cause

The root cause stems from insufficient input validation and missing authorization checks in the checkFormRequest function and its associated handlers. The plugin fails to properly sanitize user-supplied input before using it in file inclusion operations, and does not verify that requests originate from authenticated, authorized users before processing sensitive operations like settings updates and user creation.

Multiple vulnerable components have been identified including the form handler, includer module, plugin hooks, configuration controller, and user controller.

Attack Vector

The attack can be executed remotely over the network without requiring any authentication or user interaction. An attacker can craft malicious HTTP requests targeting the vulnerable checkFormRequest function to:

Include local files containing PHP code (potentially uploaded earlier as images)
Modify plugin settings to weaken security or enable further attacks
Create new administrator accounts to establish persistent access

The vulnerability is exploited by manipulating parameters passed to the form handler functions. Since the plugin does not validate file paths or check user permissions, attackers can specify arbitrary file paths for inclusion or submit requests to modify settings and create users without proper authorization checks.

For detailed technical analysis, refer to the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2024-7950

Indicators of Compromise

Unexpected administrator accounts in WordPress user database
Modified WP Job Portal plugin settings without authorized changes
Suspicious PHP files in upload directories disguised as images or other media types
Web server access logs showing requests to WP Job Portal endpoints with path traversal sequences (../)
New user registrations when registration is disabled at the site level

Detection Strategies

Monitor WordPress user creation events, particularly new administrator accounts
Implement Web Application Firewall (WAF) rules to detect path traversal attempts in request parameters
Review web server access logs for suspicious requests targeting /wp-content/plugins/wp-job-portal/ endpoints
Deploy file integrity monitoring to detect unauthorized changes to plugin settings and configuration files

Monitoring Recommendations

Enable WordPress audit logging to track settings changes and user creation events
Configure alerts for new administrator account creation
Monitor for file creation in upload directories with PHP content
Implement anomaly detection for unauthenticated requests to plugin administrative endpoints

How to Mitigate CVE-2024-7950

Immediate Actions Required

Update WP Job Portal plugin to version 2.1.7 or later immediately
Audit WordPress user accounts for any unauthorized administrator accounts created during the vulnerability window
Review and reset plugin settings to ensure no malicious modifications were made
Scan upload directories for suspicious PHP files or files with executable content
Review web server access logs for evidence of exploitation attempts

Patch Information

The vendor has released a security patch addressing these vulnerabilities. The fix is documented in WordPress Changeset #3138675. Site administrators should update to the latest version of WP Job Portal immediately through the WordPress plugin update mechanism.

Workarounds

If immediate patching is not possible, temporarily disable the WP Job Portal plugin until an update can be applied
Implement WAF rules to block requests containing path traversal sequences targeting the plugin
Restrict access to the WordPress admin area and plugin endpoints via IP allowlisting where feasible
Enable WordPress debug logging to capture suspicious activity for forensic analysis

bash

# Verify current WP Job Portal version and update via WP-CLI
wp plugin list --name=wp-job-portal --format=table
wp plugin update wp-job-portal

# Audit administrator accounts for suspicious entries
wp user list --role=administrator --format=table

# Check for recently created users
wp user list --format=table --fields=ID,user_login,user_email,user_registered,roles