CVE-2023-52212: 
WordPress vulnerability analysis and mitigation

CVE-2023-52212 is a Cross-Site Request Forgery (CSRF) vulnerability in the Automattic WP Job Manager WordPress plugin, affecting versions up to and including 2.0.0. The vulnerability was reported by researcher Rafie Muhammad on October 11, 2023, and published by Patchstack on January 5, 2024 (later formally recorded in NVD on January 5, 2026). It carries a CVSS v3.1 base score of 5.4 (Medium), assigned by Patchstack (Patchstack, Red Hat CVE).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery), meaning the plugin fails to properly validate or verify the origin of state-changing requests. An unauthenticated attacker can craft a malicious web page or link that, when visited by an authenticated WP Job Manager user, causes the victim's browser to submit unauthorized requests on their behalf. Exploitation requires user interaction — specifically, a privileged user must be tricked into clicking a malicious link or visiting a crafted page while authenticated to the WordPress site (Patchstack).

Successful exploitation could allow an attacker to force higher-privileged users to execute unwanted actions within the WP Job Manager plugin under their current authentication context, resulting in low integrity and low availability impact. Confidentiality is not directly affected. The practical consequences may include unauthorized modification of job listings, plugin settings, or other plugin-managed data, depending on the specific unprotected actions exposed by the plugin (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.048%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that while vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress sites, this specific issue is rated low priority with unlikely exploitation impact (Patchstack, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running WP Job Manager plugin version 2.0.0 or earlier, using tools like WPScan or manual inspection of plugin version metadata.
2. Craft malicious request: Construct an HTML page or link containing a forged HTTP request targeting a state-changing action endpoint within the WP Job Manager plugin (e.g., a form submission or AJAX action that lacks CSRF token validation).
3. Social engineering: Deliver the malicious link or page to an authenticated WP Job Manager user (e.g., a site administrator or employer) via phishing email, forum post, or other social engineering vector.
4. Trigger exploitation: When the victim visits the crafted page while logged into the WordPress site, their browser automatically submits the forged request with their session credentials, causing the plugin to execute the unauthorized action on their behalf.
5. Achieve objective: Depending on the unprotected action, the attacker may modify job listings, alter plugin settings, or perform other plugin-level operations without the victim's knowledge (Patchstack).

• Logs: WordPress access logs showing unexpected POST requests to WP Job Manager plugin endpoints (e.g., /wp-admin/admin-ajax.php with WP Job Manager action parameters) originating from unusual referrer URLs or external domains.
• Application: Unexplained changes to job listings, plugin configuration, or employer/applicant data within WP Job Manager that do not correspond to known administrator activity.
• Network: HTTP requests to WordPress admin or AJAX endpoints with a Referer header pointing to an external or unknown domain, which may indicate a CSRF attempt.

The vulnerability is patched in WP Job Manager version 2.1.0. All users running version 2.0.0 or earlier should update to version 2.1.0 or later immediately. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. No specific configuration-based workaround is documented; upgrading is the recommended and primary remediation (Patchstack).

The vulnerability received limited public attention, consistent with its medium/low severity rating. Wordfence included it in their weekly WordPress vulnerability report for January 1–7, 2024. No significant vendor statements beyond Patchstack's advisory or notable researcher commentary beyond the original reporter (Rafie Muhammad) have been identified (Wordfence).