CVE-2024-12213
📋 TL;DR
The WP Job Board Pro WordPress plugin has a critical privilege escalation vulnerability that allows unauthenticated attackers to register as administrators. This affects all WordPress sites using this plugin up to version 1.2.76. Attackers can gain full administrative control over vulnerable websites.
💻 Affected Systems
- WP Job Board Pro WordPress Plugin
📦 What is this software?
Superio by Apusthemes
⚠️ Risk & Real-World Impact
Worst Case
Complete site takeover with administrative privileges, allowing data theft, malware injection, defacement, and backdoor installation.
Likely Case
Attackers create administrator accounts to gain persistent access, then install malicious plugins/themes, steal sensitive data, or use the site for further attacks.
If Mitigated
With proper monitoring and detection, unauthorized admin accounts can be identified and removed before significant damage occurs.
🎯 Exploit Status
Simple HTTP POST request manipulation with the 'role' parameter set to 'administrator'.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.77 or later
Vendor Advisory: https://themeforest.net/item/superio-job-board-wordpress-theme/32180231
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins. 3. Find WP Job Board Pro. 4. Click 'Update Now' if available. 5. If not, download version 1.2.77+ from vendor and manually update.
🔧 Temporary Workarounds
Disable User Registration
allTemporarily disable user registration in WordPress settings to prevent exploitation.
Deactivate Plugin
allDeactivate WP Job Board Pro plugin until patched.
🧯 If You Can't Patch
- Disable the WP Job Board Pro plugin immediately.
- Implement web application firewall rules to block registration requests containing 'role' parameter.
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin > Plugins > WP Job Board Pro version. If version is 1.2.76 or lower, you are vulnerable.Check Version:
wp plugin list --name='WP Job Board Pro' --field=versionVerify Fix Applied:
After updating, verify plugin version is 1.2.77 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual user registration events
- New administrator accounts created from unexpected IPs
- POST requests to registration endpoints with 'role' parameter
Network Indicators:
- HTTP POST to /wp-admin/admin-ajax.php or registration endpoints with role=administrator
SIEM Query:
source="wordpress.log" AND ("user_registered" OR "new_user") AND "administrator"