Vulnerability · Published Dec 19, 2022 · Assigned by WPScan
CVE-2022-4061JobBoardWP < 1.2.2 - Unauthenticated Arbitrary File Upload
High 7.5
In plain English
A high-severity security flaw in JobBoardWP from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.4%top 27.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC
Official description
The JobBoardWP WordPress plugin before 1.2.2 does not properly validate file names and types in its file upload functionalities, allowing unauthenticated users to upload arbitrary files such as PHP.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | JobBoardWP | 0 – before 1.2.2 |
References
- https://wpscan.com/vulnerability/fec68e6e-f612-43c8-8301-80f7ae3be665 exploit, vdb-entry, technical-description