CVE-2023-6585: 
WordPress vulnerability analysis and mitigation

CVE-2023-6585 affects the WP JobSearch WordPress plugin versions before 2.3.4. The vulnerability was discovered and reported by Furkan Gedik, with public disclosure on November 24, 2023 (WPScan).

The vulnerability stems from the plugin's failure to validate uploaded files, which creates a security weakness in the file upload functionality. The vulnerability has received a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, indicating a high-severity issue with network accessibility and no authentication requirements (CISA-ADP).

This vulnerability allows unauthenticated attackers to upload arbitrary files, including malicious PHP files, directly to the server. This capability could lead to remote code execution on the affected WordPress installations (WPScan).

The vulnerability is exploitable by unauthenticated attackers through the WordPress AJAX functionality. A proof of concept exists demonstrating the ability to upload arbitrary PHP files to the server using a specific HTTP POST request to the wp-admin/admin-ajax.php endpoint (WPScan).

Users should immediately update their WP JobSearch WordPress plugin to version 2.3.4 or later, which contains the security fix for this vulnerability (WPScan).