CVE-2022-4061 JobBoardWP < 1.2.2 - Unauthenticated Arbitrary File Upload
Unauthenticated attackers can upload arbitrary files, including PHP, leading to remote code execution on JobBoardWP installations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-4061?
CVE-2022-4061 is a high-severity vulnerability in Unknown JobBoardWP, published on 19 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The JobBoardWP WordPress plugin before 1.2.2 does not properly validate file names and types in its file upload functionalities, allowing unauthenticated users to upload arbitrary files such as PHP.
Which versions are affected by CVE-2022-4061?
It affects 1 product.
Products include Ultimatemember Jobboardwp.
How do I fix CVE-2022-4061?
No fix has been published for CVE-2022-4061 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-4061 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-4061 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Unknown JobBoardWP
- CVE-2024-10880 JobBoardWP – Job Board Listings and Submissions <= 1.3.0 - Reflected Cross-Site Scripting
- CVE-2021-39329 JobBoardWP – Job Board Listings and Submissions <= 1.0.7 Authenticated Stored Cross-Site Scripting
- CVE-2023-23715 WordPress JobBoardWP – Job Board Listings and Submissions plugin <= 1.2.2 - IDOR Leading To Job Removal Vulnerability
Sources
Also known as GHSA-3459-2j34-8x8g.