CVE-2023-6585 JobSearch WP Job Board < 2.3.4 - Arbitrary File Upload to RCE

2024-02-2708:30:25

WPScan

github.com

wp jobsearch

unauthenticated

arbitrary files

rce

AI Score

7.1

Confidence

High

SSVC

Exploitation

poc

Automatable

yes

Technical Impact

partial

JSON

The WP JobSearch WordPress plugin before 2.3.4 does not validate files to be uploaded, which could allow unauthenticated attackers to upload arbitrary files such as PHP on the server

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:eyecix:jobsearch_wp_job_board:*:*:*:*:*:wordpress:*:*"
    ],
    "vendor": "eyecix",
    "product": "jobsearch_wp_job_board",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "2.3.4",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]