Vulnerability · Published Sep 25, 2023 · Assigned by WPScan

CVE-2023-4490WP Job Portal < 2.0.6 - Unauthenticated SQLi

Critical 9.8

In plain English

A critical-severity security flaw in WP Job Portal from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 3.6% (higher than 89% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)3.6%top 10.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Nuclei

Official description

The WP Job Portal WordPress plugin before 2.0.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users

Affected products (as reported)

Vendor	Product	Versions
Unknown	WP Job Portal	0 – before 2.0.6

References

https://wpscan.com/vulnerability/986024f0-3c8d-44d8-a9c9-1dd284d7db0d exploit, vdb-entry, technical-description