JS Job Manager, 4e1f7d7c-f78d-4e4d-be5c-01af042026b8

CVE, Research URL: 4e1f7d7c-f78d-4e4d-be5c-01af042026b8
Home page URL: Security reports for JS Job Manager
Application: JS Job Manager
Published on: -
Research Description: JS Job Manager [js-jobs] < 1.1.9 JS Job Manager < 1.1.9 - Unauthenticated Arbitrary Plugin Installation/Activation The jsjobs_ajax AJAX action of the plugin available to both authenticated and unauthenticated users does not have proper authorisation and CSRF checks, in particular when using the installPluginFromAjax and activatePluginFromAjax, which could allow unauthenticated attackers to install arbitrary plugins from the WordPress repository, and active them (with some limitation).
Affected versions: max 1.1.9.
Status: vulnerable