High severity · published Feb 27, 2024
CVE-2023-6585
The WP JobSearch WordPress plugin before 2.3.4 does not validate files to be uploaded, which could allow unauthenticated attackers to upload arbitrary files such as PHP on the…
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
The WP JobSearch WordPress plugin before 2.3.4 does not validate files to be uploaded, which could allow unauthenticated attackers to upload arbitrary files such as PHP on the server
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JW
Jobsearch WP Job Board · Eyecix
before 2.3.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-6585
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-6585
Exploit
https://wpscan.com/vulnerability/757412f4-e4f8-4007-8e3b-639a72b33180/
More from Jobsearch WP Job Board
9.8
CVE-2024-11925
WP JobSearch <= 2.6.7 - Authentication Bypass to Account Takeover and Privilege Escalation
9.8
CVE-2024-8615
WP JobSearch <= 2.6.7 - Unauthenticated Arbitrary File Upload
9.8
CVE-2024-43929
WordPress JobSearch WP Job Board WordPress Plugin plugin <= 2.5.4 - Broken Access Control vulnerability
9.8
CVE-2024-47636
WordPress WP JobSearch plugin <= 2.5.9 - PHP Object Injection vulnerability
9.8
CVE-2024-43931
Deserialization of Untrusted Data vulnerability in eyecix JobSearch allows Object Injection.This issue affects JobSearch: from n/a through 2.5.3