CVE-2024-11715

Executive Summary

CVE-2024-11715 is a privilege escalation vulnerability in the WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress, affecting all versions up to and including 2.2.2. The flaw resides in the assignUserRole() function, which lacks a capability check, allowing unauthenticated attackers to elevate their privileges to that of an employer. This can lead to unauthorized access to employer-level features, including job postings, candidate management, and potentially sensitive data. The vulnerability has a CVSS score of 4.8 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time, but the lack of a patch makes it a persistent risk for unsecured installations.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem. Since the plugin is distributed via the WordPress Plugin Directory, any site running an affected version is at risk. No official patch has been released, and the vendor has not responded to disclosure. Users should consider removing or replacing the plugin until a fix is available.

CVSS Breakdown & Threat Level

• CVSS Score: 4.8 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is medium due to the low complexity and no authentication requirement, but the impact is limited to low confidentiality and integrity loss. However, privilege escalation to employer role could enable further attacks.

Deep Dive & Mechanics

The vulnerability exists in the assignUserRole() function within the WP Job Portal plugin. This function is intended to assign roles to users, but it is exposed via AJAX or REST endpoints without proper capability checks. An unauthenticated attacker can craft a request to this function, specifying a user ID (or creating a new user) and the role "employer". The function then updates the user's role in the WordPress database, granting employer-level privileges.

The root cause is a missing current_user_can() check or similar authorization mechanism. The function likely uses wp_update_user() or $wpdb->update() to change the user role, but does not verify that the requesting user has administrative or appropriate capabilities.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.2.2):

function assignUserRole() {
    $user_id = $_POST['user_id'];
    $role = $_POST['role'];
    $user = new WP_User($user_id);
    $user->set_role($role);
    wp_send_json_success();
}
add_action('wp_ajax_nopriv_assign_user_role', 'assignUserRole');

Patched Code (Hypothetical):

function assignUserRole() {
    if (!current_user_can('manage_options')) {
        wp_send_json_error('Unauthorized');
        return;
    }
    $user_id = intval($_POST['user_id']);
    $role = sanitize_text_field($_POST['role']);
    $user = new WP_User($user_id);
    $user->set_role($role);
    wp_send_json_success();
}
add_action('wp_ajax_assign_user_role', 'assignUserRole');

The patched version adds a capability check (current_user_can('manage_options')) and restricts the action to authenticated users only (removing nopriv). Input sanitization is also added.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with WP Job Portal plugin version <= 2.2.2.
• No authentication required.

Exploitation Steps:

1. Identify the AJAX endpoint: wp-admin/admin-ajax.php?action=assign_user_role.
2. Send a POST request with parameters user_id (existing user ID or 0 for new) and role=employer.
3. The attacker can then log in as that user (if password known) or use the elevated privileges.

Example cURL command:

curl -X POST http://target.com/wp-admin/admin-ajax.php \
  -d "action=assign_user_role&user_id=1&role=employer"

Note: No public exploit code is available, but the above demonstrates the attack vector.

Blue Team

Detection:

• Monitor for POST requests to /wp-admin/admin-ajax.php with action=assign_user_role.
• Look for unusual user role changes in WordPress logs.
• Use the Sigma rule below to detect the AJAX action.

Honeypot:

• Create a fake user with low privileges and monitor for role changes.

Indicators of Compromise (IOCs)

• Network: POST requests to /wp-admin/admin-ajax.php with action=assign_user_role.
• Logs: WordPress user role changes in wp_usermeta table.
• File: Presence of the vulnerable plugin file (e.g., wp-job-portal/includes/class-user.php).
• User: New or modified users with role "employer" without proper authorization.

Detection Engineering

YARA Rule

rule wp_job_portal_priv_esc {
    meta:
        description = "Detects vulnerable WP Job Portal plugin code"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-11715"
    strings:
        $func = "function assignUserRole"
        $ajax = "wp_ajax_nopriv_assign_user_role"
    condition:
        $func and $ajax
}

Sigma Rule

title: WP Job Portal Privilege Escalation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2024-11715 via AJAX action
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/wp-admin/admin-ajax.php'
        cs-uri-query: 'action=assign_user_role'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2024-11715 WP Job Portal Privilege Escalation";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=assign_user_role"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is available.
2. Remove the vulnerable function by editing the plugin file (if possible) to add capability checks.
3. Implement a Web Application Firewall (WAF) rule to block requests with action=assign_user_role.

Long-term:

• Monitor the plugin's page for updates.
• Consider replacing the plugin with an alternative that is actively maintained.
• Apply the principle of least privilege to all WordPress roles.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.