CVE-2024-8614

Name of the Vulnerable Software and Affected Versions: JobSearch WP Job Board plugin for WordPress versions up to, and including, 2.6.7

Description: The issue is related to missing file type validation in the jobsearch wp handle upload() function, allowing authenticated attackers with subscriber-level access and above to upload arbitrary files on the affected site's server. This may make remote code execution possible.

Recommendations: For versions up to, and including, 2.6.7, update to a version that includes a fix for the missing file type validation in the jobsearch wp handle upload() function. As a temporary workaround, consider disabling the jobsearch wp handle upload() function until a patch is available. Restrict access to the file upload feature to minimize the risk of exploitation.