CVE-2024-13873
📋 TL;DR
This vulnerability allows authenticated WordPress users with Subscriber-level access or higher to delete profile photos from other user accounts. It affects all versions of the WP Job Portal plugin up to 2.2.8. Attackers can exploit this by manipulating user IDs in requests to the deleteUserPhoto() function.
💻 Affected Systems
- WP Job Portal – A Complete Recruitment System for Company or Job Board
📦 What is this software?
Wp Job Portal by Wpjobportal
⚠️ Risk & Real-World Impact
Worst Case
Mass deletion of user profile photos across the entire WordPress site, potentially disrupting user experience and causing confusion.
Likely Case
Targeted deletion of profile photos from specific user accounts, causing minor disruption and requiring manual restoration.
If Mitigated
No impact if proper authorization checks are implemented or plugin is updated.
🎯 Exploit Status
Exploitation requires authenticated access but is technically simple - involves manipulating user ID parameters in HTTP requests.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.2.9
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find WP Job Portal plugin. 4. Click 'Update Now' if update is available. 5. Alternatively, download version 2.2.9+ from WordPress repository and manually update.
🔧 Temporary Workarounds
Temporary Plugin Deactivation
allDisable the WP Job Portal plugin until patched
wp plugin deactivate wp-job-portal
Access Restriction
allRestrict plugin access to trusted users only using WordPress roles
🧯 If You Can't Patch
- Implement web application firewall rules to block suspicious deleteUserPhoto requests
- Monitor and audit user photo deletion activities in WordPress logs
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → WP Job Portal version. If version is 2.2.8 or lower, system is vulnerable.Check Version:
wp plugin get wp-job-portal --field=versionVerify Fix Applied:
Verify plugin version is 2.2.9 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Multiple DELETE requests to uploads.php with different user ID parameters
- Unusual pattern of profile photo deletions from non-admin users
Network Indicators:
- HTTP POST/DELETE requests to wp-job-portal endpoints with manipulated user_id parameters
SIEM Query:
source="wordpress.log" AND "deleteUserPhoto" AND user_role="subscriber"