CVE-2024-1813

Name of the Vulnerable Software and Affected Versions Simple Job Board versions prior to 2.11.1

Description Unauthenticated attackers can perform PHP Object Injection through the deserialization of untrusted input within the job board applicant list columns value() function. If a POP chain (a sequence of gadgets used to execute arbitrary code during deserialization) is available via other installed plugins or themes, this could lead to the deletion of arbitrary files, retrieval of sensitive data, or remote code execution when a submitted job application is viewed.

Recommendations Update to a version later than 2.11.0. As a temporary workaround, restrict access to the job board applicant list columns value() function to minimize the risk of exploitation.