CVE-2023-4490

published 2023-09-25

CVE-2023-4490: The WP Job Portal WordPress plugin before 2.0.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection…

Priority P1 80 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

ITW EXPLOIT VulnCheck KEV

The WP Job Portal WordPress plugin before 2.0.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users

Affected

1 ranges

Vendor	Product	Version range	Fixed in
wpjobportal	wp_job_portal	< 2.0.6	2.0.6

Detection & IOCs extracted from sources · hover to see the quote

path wp-content/plugins/wp-job-portal

• → SQL injection is exploitable by unauthenticated users via an unsanitised parameter in WP Job Portal before version 2.0.6; monitor for SQL injection payloads (e.g. single-quote probes) in requests targeting this plugin's endpoints.
• → The vulnerability is a SQL injection in WP Job Portal WordPress plugin before 2.0.6 triggered by an unsanitised parameter, exploitable without authentication. ↗

• · The detection template targets WP Job Portal versions up to (not including) 2.0.6; ensure version checks are applied to avoid false positives on patched installations. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vulncheck 9.8 CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89