Simple Job Board < 2.12.6 - Unauthenticated Resumes Download
Priority MEDIUM 51Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.
Summary
The Simple Job Board WordPress plugin before 2.12.6 does not prevent uploaded files from being listed, allowing unauthenticated users to access and download uploaded resumes
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00421 36th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed Simple Job Board (Unknown): 2.12.6
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Simple Job Board | before 2.12.6 | 2.12.6 | Patch available | CNA |
- Simple Job Board VendorUnknown Affected before 2.12.6 Fixed in 2.12.6 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:presstigers:simple_job_board:*:*:*:*:*:wordpress:*:* | before 2.12.6 | Vulnerable | PressTigers |
- cpe:2.3:a:presstigers:simple_job_board:*:*:*:*:*:wordpress:*:* Versions before 2.12.6 Vulnerable ·PressTigers
Remediation
- Fix · CNA Simple Job Board (Unknown) Fixed in 2.12.6
Timeline
- 2026-10-02 Threatist record created from CVE-2024-7762
- 2026-10-03 Alias added: GHSA-p9xg-r2f4-c78v
References
More PressTigers Simple Job Board vulnerabilities
- TI-2024-07195 Simple Job Board < 2.12.2 - Admin+ Stored XSS CVSS 3.1MEDIUM 6.1
- TI-2024-01689 Simple Job Board <= 2.11.0 - Unauthenticated PHP Object Injection via Job Application Fields CVSS 3.1CRITICAL 9.8
- TI-2023-25511 WordPress Simple Job Board plugin <= 2.10.5 - Broken Access Control vulnerability CVSS 3.1CRITICAL 9.8
- TI-2023-13820 WordPress Simple Job Board Plugin <= 2.10.3 is vulnerable to Cross Site Request Forgery (CSRF) CVSS 3.1HIGH 8.8
- TI-2023-28561 WordPress Simple Job Board Plugin <= 2.10.6 is vulnerable to Cross Site Request Forgery (CSRF) CVSS 3.1HIGH 8.8
- TI-2024-06812 Simple Job Board <= 2.12.3 - Authenticated (Editor+) PHP Object Injection CVSS 3.1HIGH 7.2
Sources
- CVE-2024-7762 · CVE Program
- CVE-2024-7762 · NVD
- FIRST EPSS
- GHSA-p9xg-r2f4-c78v · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences