Cyber Posture

CVE-2024-12810

High

Published: 14 March 2025

Published
14 March 2025
Modified
27 March 2025
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0009 25.3th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may delete files left behind by the actions of their intrusion activity.

Security Summary

CVE-2024-12810 is a vulnerability in the JobCareer | Job Board Responsive WordPress Theme for WordPress, affecting all versions up to and including 7.1. It stems from missing capability checks on multiple functions, enabling unauthorized access, modification, and loss of data. The issue is classified under CWE-862 (Missing Authorization) and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for confidentiality, integrity, and availability impacts.

Authenticated attackers with Subscriber-level access or higher can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation allows them to delete arbitrary files, generate backups, restore backups, update theme options, and reset theme options to default settings, potentially leading to full theme compromise and broader site disruption.

Advisories detailing mitigation are available from sources including Wordfence at https://www.wordfence.com/threat-intel/vulnerabilities/id/24889552-0db6-44e6-9b12-f31b5e92a42e?source=cve and the theme's page on ThemeForest at https://themeforest.net/item/jobcareer-job-board-responsive-wordpress-theme/14221636. The vulnerability was published on 2025-03-14T12:15:13.483.

Details

CWE(s)
CWE-862

Affected Products

chimpgroup
jobcareer
≤ 7.1

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1070.004 File Deletion Stealth
Adversaries may delete files left behind by the actions of their intrusion activity.
attack.mitre.org →
Why these techniques?

The vulnerability in the public-facing WordPress theme allows authenticated low-privilege users to exploit missing authorization checks for arbitrary file deletion and other disruptive actions, mapping to exploitation of public-facing applications, privilege escalation, and file deletion.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References