CVE-2024-1813
📋 TL;DR
The Simple Job Board WordPress plugin is vulnerable to PHP object injection via deserialization of untrusted input, allowing unauthenticated attackers to inject malicious PHP objects. If a POP chain exists via another plugin or theme, attackers could delete files, steal data, or execute arbitrary code when viewing job applications. All WordPress sites using Simple Job Board version 2.11.0 or earlier are affected.
💻 Affected Systems
- Simple Job Board WordPress Plugin
📦 What is this software?
Simple Job Board by Presstigers
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and website defacement.
Likely Case
Arbitrary file deletion or sensitive data exposure if POP chains exist in common plugins/themes.
If Mitigated
Limited impact if no POP chains exist, but still represents a serious security flaw.
🎯 Exploit Status
Exploitation requires understanding of PHP object injection and available POP chains. CVSS 9.8 indicates critical severity.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.11.1
Vendor Advisory: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3051715%40simple-job-board&old=3038476%40simple-job-board
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find Simple Job Board and click 'Update Now'. 4. Verify version shows 2.11.1 or higher.
🔧 Temporary Workarounds
Disable Simple Job Board Plugin
allTemporarily disable the vulnerable plugin until patching is possible.
wp plugin deactivate simple-job-board
Web Application Firewall Rules
allBlock requests containing serialized PHP object patterns.
🧯 If You Can't Patch
- Disable the Simple Job Board plugin immediately.
- Implement strict WAF rules to block PHP serialization patterns in HTTP requests.
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → Simple Job Board → Version. If version is 2.11.0 or lower, you are vulnerable.Check Version:
wp plugin get simple-job-board --field=versionVerify Fix Applied:
After updating, verify Simple Job Board version shows 2.11.1 or higher in WordPress plugins list.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to job application endpoints
- PHP deserialization errors in web server logs
- Unexpected file deletion or creation events
Network Indicators:
- HTTP requests containing serialized PHP object patterns (O:)
- Traffic spikes to /wp-content/plugins/simple-job-board/
SIEM Query:
source="web_logs" AND (uri_path="*simple-job-board*" AND (http_method="POST" AND content="*O:*"))🔗 References
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3051715%40simple-job-board&old=3038476%40simple-job-board&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/89584034-4a93-42a6-8fef-55dc3895c45c?source=cve
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3051715%40simple-job-board&old=3038476%40simple-job-board&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/89584034-4a93-42a6-8fef-55dc3895c45c?source=cve
