CVE-2024-11711 – This SQL injection vulnerability in the WP Job ... (How to Fix)

Q: What is the severity of CVE-2024-11711?

CVE-2024-11711 has a CVSS score of 7.5 (HIGH). This SQL injection vulnerability in the WP Job Portal WordPress plugin allows unauthenticated attackers to inject malicious SQL queries via the 'resumeid' parameter. Attackers can extract sensitive database information including user credentials, job applications, and other recruitment data. All WordPress sites using WP Job Portal versions 2.2.1 and earlier are affected.

📋 TL;DR

This SQL injection vulnerability in the WP Job Portal WordPress plugin allows unauthenticated attackers to inject malicious SQL queries via the 'resumeid' parameter. Attackers can extract sensitive database information including user credentials, job applications, and other recruitment data. All WordPress sites using WP Job Portal versions 2.2.1 and earlier are affected.

💻 Affected Systems

Products:

WP Job Portal WordPress Plugin

Versions: All versions up to and including 2.2.1

Operating Systems: All

Default Config Vulnerable: ⚠️ Yes

Notes: All WordPress installations with vulnerable plugin versions are affected regardless of configuration.

📦 What is this software?

Wp Job Portal by Wpjobportal

View all CVEs affecting Wp Job Portal →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete database compromise leading to theft of all user data, administrative credentials, and potential website takeover through privilege escalation.

🟠

Likely Case

Extraction of sensitive recruitment data including resumes, job applications, personal information, and user credentials.

🟢

If Mitigated

Limited data exposure if database permissions are properly configured and sensitive data is encrypted.

🌐 Internet-Facing: HIGH

🏢 Internal Only: LOW

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

SQL injection via GET/POST parameters requires minimal technical skill. Public proof-of-concept code exists in GitHub gists.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.2.3

Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3202327/wp-job-portal/tags/2.2.3/modules/resume/model.php

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins. 3. Find WP Job Portal. 4. Click 'Update Now' if available. 5. If manual update needed, download version 2.2.3+ from WordPress.org and replace plugin files.

🔧 Temporary Workarounds

Temporary Plugin Deactivation

all

Disable the vulnerable plugin until patched

wp plugin deactivate wp-job-portal

Web Application Firewall Rule

linux

Block SQL injection patterns targeting resumeid parameter

ModSecurity rule: SecRule ARGS:resumeid "@detectSQLi" "id:1001,phase:2,deny,status:403"

🧯 If You Can't Patch

Implement strict input validation for all resumeid parameters
Deploy web application firewall with SQL injection protection rules

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel > Plugins > WP Job Portal version number

Check Version:

wp plugin get wp-job-portal --field=version

Verify Fix Applied:

Verify plugin version is 2.2.3 or higher and review the resume/model.php file for proper parameterized queries

📡 Detection & Monitoring

Log Indicators:

Unusual SQL error messages in WordPress logs
Multiple requests with resumeid parameter containing SQL keywords
High volume of requests to resume-related endpoints

Network Indicators:

HTTP requests with resumeid parameter containing UNION, SELECT, OR 1=1, --, #, /* patterns

SIEM Query:

source="wordpress.log" AND ("resumeid" AND ("UNION" OR "SELECT" OR "1=1" OR "--" OR "#" OR "/*"))

📊 Metadata

CVE ID: CVE-2024-11711

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE: CWE-89

Published: December 14, 2024

Last Updated: February 5, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-11711, you might also want to check these: