CVE-2024-12131

Executive Summary

CVE-2024-12131 is an Insecure Direct Object Reference (IDOR) vulnerability in the WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress, affecting all versions up to and including 2.2.5. This vulnerability allows authenticated attackers with Subscriber-level access or higher to submit resumes on behalf of other applicants when applying for jobs. The flaw stems from missing validation on a user-controlled key, enabling unauthorized manipulation of application data. As a WordPress plugin vulnerability, it directly impacts the WordPress ecosystem, not the underlying web server software.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to monitor the plugin’s update channel for a patched version. No known supply chain compromise has been reported, but the lack of a patch increases risk for sites using this plugin.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber-level)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

The low EPSS score (0.0%) suggests limited active exploitation, but the vulnerability’s simplicity and the lack of a patch elevate the risk for unpatched installations.

Deep Dive & Mechanics

The vulnerability resides in the resume submission functionality of the WP Job Portal plugin. When an authenticated user applies for a job, the plugin processes a request that includes a user-controlled key (likely a user ID or application ID) to associate the resume with a specific applicant. Due to missing validation, an attacker can modify this key to submit a resume under another user’s identity. This IDOR flaw allows privilege escalation within the application context, enabling attackers to impersonate other applicants and potentially manipulate hiring processes.

The attack flow:

1. Authenticate as a Subscriber.
2. Intercept the resume submission request.
3. Modify the user-controlled key (e.g., user_id or applicant_id) to target another user.
4. Submit the request, causing the resume to be associated with the victim.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern is inferred. The plugin likely uses a parameter like user_id without verifying it matches the authenticated user.

Vulnerable Code (PHP):

// Vulnerable: No ownership check
$user_id = $_POST['user_id'];
$resume_data = $_POST['resume_data'];
$wpdb->insert('wp_job_applications', array(
    'user_id' => $user_id,
    'resume' => $resume_data
));

Patched Code (Expected):

// Patched: Verify user ownership
$current_user_id = get_current_user_id();
$user_id = $_POST['user_id'];
if ($user_id != $current_user_id) {
    wp_die('Unauthorized');
}
$resume_data = $_POST['resume_data'];
$wpdb->insert('wp_job_applications', array(
    'user_id' => $user_id,
    'resume' => $resume_data
));

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with WP Job Portal plugin (version <= 2.2.5).
• Attacker account with Subscriber-level access.
• Burp Suite or similar proxy.

Exploitation Steps:

1. Log in as a Subscriber.
2. Navigate to a job listing and initiate an application.
3. Intercept the POST request to the plugin’s AJAX handler (e.g., wp-admin/admin-ajax.php?action=wp_job_portal_submit_resume).
4. Locate the parameter controlling the applicant ID (e.g., applicant_id or user_id).
5. Modify this parameter to a target user’s ID.
6. Forward the request.
7. Verify the resume appears under the victim’s profile.

Example Request (Burp):

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target-site.com
Content-Type: application/x-www-form-urlencoded
Cookie: wordpress_logged_in_...

action=wp_job_portal_submit_resume&job_id=123&applicant_id=456&resume_data=...

Blue Team

Detection:

• Monitor for multiple resume submissions from the same IP or user account within a short timeframe.
• Alert on requests where applicant_id differs from the authenticated user’s ID.
• Review application logs for unusual patterns in resume submission parameters.

Hunting:

• Search for HTTP requests to admin-ajax.php with action=wp_job_portal_submit_resume and anomalous applicant_id values.
• Correlate user IDs with session tokens to detect mismatches.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /wp-admin/admin-ajax.php with action=wp_job_portal_submit_resume and manipulated applicant_id parameter.
• Logs: WordPress debug logs showing wp_job_applications table inserts with mismatched user_id and session user.
• File: No specific file IOCs; the vulnerability is logic-based.

Detection Engineering

YARA Rule

rule CVE_2024_12131_WP_Job_Portal_IDOR {
    meta:
        description = "Detects exploitation attempts of CVE-2024-12131 in WP Job Portal plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-12131"
    strings:
        $ajax_action = "wp_job_portal_submit_resume"
        $applicant_id = /applicant_id=[0-9]+/
        $user_id = /user_id=[0-9]+/
    condition:
        $ajax_action and ($applicant_id or $user_id)
}

Sigma Rule

title: CVE-2024-12131 WP Job Portal IDOR Exploitation
id: 8a3f7c2e-5d1b-4a9f-8c6e-2b1d3f4a5c6d
status: experimental
description: Detects HTTP POST requests targeting WP Job Portal resume submission with potential IDOR manipulation
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: 'action=wp_job_portal_submit_resume'
        cs-uri-query|re: '(applicant_id|user_id)=[0-9]+'
    condition: selection
falsepositives:
    - Legitimate resume submissions by authorized users
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-12131 WP Job Portal IDOR Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=wp_job_portal_submit_resume"; http_client_body; pcre:"/(applicant_id|user_id)=[0-9]+/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the WP Job Portal plugin until a patch is released.
2. Implement a Web Application Firewall (WAF) rule to block requests with manipulated applicant_id or user_id parameters.
3. Restrict Subscriber-level access to job application features if possible.

Long-term Fix:

• Apply server-side validation to ensure the user_id matches the authenticated user.
• Use nonce tokens to prevent CSRF and enforce ownership checks.
• Monitor the plugin vendor for a security update and apply it promptly.

Workaround:

• Modify the plugin code to add ownership checks (see patched code example) if you have development resources.

Report generated by Valters IT DevSecOps Intelligence