CVE-2024-1813: 
WordPress vulnerability analysis and mitigation

The Simple Job Board plugin for WordPress contains a PHP Object Injection vulnerability (CVE-2024-1813) affecting all versions up to and including 2.11.0. The vulnerability exists in the job_board_applicant_list_columns_value function, which performs unsafe deserialization of untrusted input (NVD).

The vulnerability is classified with a CVSS v3.1 Base Score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The issue stems from improper handling of deserialization operations in the job_board_applicant_list_columns_value function, which allows for PHP Object Injection. The vulnerability is tracked as CWE-502 (Deserialization of Untrusted Data) (NVD).

If successfully exploited, this vulnerability could allow unauthenticated attackers to inject PHP Objects. When combined with a POP chain present in additional plugins or themes on the target system, attackers could potentially delete arbitrary files, retrieve sensitive data, or execute code when a submitted job application is viewed (NVD).

The vulnerability is particularly severe as it requires no authentication (unauthenticated) and can be exploited remotely with low attack complexity. The attack vector becomes active when a submitted job application is viewed (NVD).

Users should upgrade to version 2.11.1 or later of the Simple Job Board plugin to address this vulnerability (NVD).