CVE-2024-8614: JobSearch WP Job Board RCE Vulnerability

CVE-2024-8614 Overview

CVE-2024-8614 is an arbitrary file upload vulnerability in the JobSearch WP Job Board plugin for WordPress. The flaw exists in the jobsearch_wp_handle_upload() function, which fails to validate file types during upload operations. All plugin versions up to and including 2.6.7 are affected. Authenticated users with subscriber-level access or higher can upload arbitrary files to the server, potentially achieving remote code execution. The vulnerability is classified under [CWE-434] (Unrestricted Upload of File with Dangerous Type).

Critical Impact
Authenticated attackers with minimal (subscriber) privileges can upload executable files such as PHP scripts, leading to remote code execution and full site compromise.

Affected Products

eyecix JobSearch WP Job Board plugin for WordPress, all versions up to and including 2.6.7
WordPress sites where the plugin is installed and activated
WordPress sites permitting subscriber-level registration alongside the vulnerable plugin

Discovery Timeline

2024-11-06 - CVE-2024-8614 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8614

Vulnerability Analysis

The JobSearch WP Job Board plugin exposes an upload handler intended for job seekers to submit resumes and related documents. The jobsearch_wp_handle_upload() function processes uploaded files but omits validation of file extensions and MIME types against a safe allowlist. As a result, attackers can submit files with executable extensions such as .php, .phtml, or .phar. Once written into a web-accessible directory, these files can be requested directly by the attacker, invoking the PHP interpreter and executing attacker-controlled code within the WordPress process context.

Root Cause

The root cause is missing server-side file type validation inside jobsearch_wp_handle_upload(). The function does not enforce an extension allowlist, does not verify MIME content against expected document formats, and does not rename uploaded files to non-executable extensions. WordPress role-based authorization checks only require subscriber-level access, which many public WordPress sites grant freely via open registration.

Attack Vector

An attacker registers a subscriber account or reuses existing low-privilege credentials. Authenticated, the attacker sends a crafted multipart HTTP POST request to the plugin's upload endpoint containing a malicious PHP payload. The plugin writes the file to the WordPress uploads directory without stripping or rewriting the extension. The attacker then issues a direct HTTP request to the uploaded file's URL, causing the web server to execute the payload and yielding remote code execution under the web server user. See the Wordfence Vulnerability Report for additional context.

// No verified public proof-of-concept code is available.
// The vulnerability mechanism is described in prose above.

Detection Methods for CVE-2024-8614

Indicators of Compromise

Files with executable extensions (.php, .phtml, .phar, .pht) written under wp-content/uploads/ or plugin-specific upload directories
HTTP POST requests to JobSearch plugin upload endpoints originating from newly registered subscriber accounts
Direct GET requests to unfamiliar PHP files inside upload directories, followed by outbound network activity from the web server
Newly created WordPress administrator accounts or unexpected modifications to wp-config.php and theme files

Detection Strategies

Inventory WordPress deployments and identify installations of the JobSearch WP Job Board plugin at version 2.6.7 or earlier
Scan the WordPress uploads directory for files whose extension does not match expected document or image types
Correlate authentication logs to detect subscriber-role accounts issuing multipart upload requests followed by direct file access
Review web server access logs for POST requests to plugin upload handlers followed by GET requests returning HTTP 200 for .php resources

Monitoring Recommendations

Alert on process execution chains where the web server user (www-data, apache, nginx) spawns shells, curl, wget, or scripting interpreters
Monitor file integrity on the WordPress document root and uploads directory for newly created executable content
Ingest WordPress and web server logs into a centralized analytics platform to correlate upload activity with post-exploitation behavior
Track outbound connections from PHP-FPM or Apache worker processes to unknown external hosts

How to Mitigate CVE-2024-8614

Immediate Actions Required

Update the JobSearch WP Job Board plugin to a version later than 2.6.7 as soon as a fixed release is available from the vendor
Disable the plugin if a patched version is not yet installed and the plugin is not required for business operations
Disable open user registration or restrict the default new-user role to prevent anonymous acquisition of subscriber accounts
Audit the wp-content/uploads/ directory and remove any unauthorized PHP or executable files

Patch Information

The vendor distributes the JobSearch WP Job Board plugin through CodeCanyon. Administrators should consult the CodeCanyon Job Board Plugin listing and the Wordfence Vulnerability Report for the latest fixed version and remediation guidance. Apply the update across all affected WordPress installations and verify the plugin version after upgrade.

Workarounds

Configure the web server to deny PHP execution within wp-content/uploads/ using directives such as php_flag engine off in Apache or a location block returning 403 for .php in Nginx
Deploy a web application firewall rule that blocks multipart uploads containing PHP tags or executable extensions to the affected endpoints
Enforce least privilege by removing unused subscriber accounts and requiring administrator approval for new registrations
Restrict access to the plugin's upload handler through IP allowlisting where operationally feasible

bash

# Apache: prevent PHP execution in the WordPress uploads directory
# Place this file at wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar|pht|php3|php4|php5|php7)$">
    Require all denied
</FilesMatch>