CVE-2023-29384

The vulnerability classified as CWE-434 consists of the lack of proper validation and restrictions on the types of uploaded files. An unauthenticated attacker can remotely upload an executable file (e.g., PHP webshell) to the WordPress server. Once the malicious file is placed, it is possible to execute it directly in the context of the web server, which leads to full takeover of control over the application and system.

An attacker can gain full control over the server, including reading and modifying sensitive data, installing backdoors, and the ability to perform further lateral movement within the infrastructure. The scope of compromise includes confidentiality, integrity, and availability of the system to a critical degree.

The JobWP plugin should be immediately updated to a version higher than 2.0 through the WordPress admin panel or apply patches available from the vendor according to references published by Patchstack. Until the update is applied, consider disabling the plugin.

WordPress Job Board and Recruitment Plugin – JobWP in versions from the beginning of the plugin's existence through version 2.0 inclusive.