CVE-2024-11917
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedThe JobSearch WP Job Board plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.9.2. This is due to improper configurations in the 'jobsearch_xing_response_data_callback', 'set_access_tokes', and 'google_callback' functions. This makes it possible for unauthenticated attackers to log in as the first connected Xing user, or any connected Xing user if the Xing id is known. It is also possible for unauthenticated attackers to log in as the first connected Google user if the user has logged in, without subsequently logging out, in thirty days. The vulnerability was partially patched in version 2.8.4.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceThe JobSearch WP Job Board plugin for WordPress versions up to 2.9.2 contain improper configuration vulnerabilities in OAuth/social login callback functions (jobsearch_xing_response_data_callback, set_access_tokes, and google_callback) that allow unauthenticated attackers to bypass authentication and impersonate connected Xing or Google users based on login order or known social IDs.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- High
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Check installed JobSearch plugin versionIn WordPress admin, go to Plugins > Installed Plugins and find JobSearch WP Job Board. The version number is displayed below the plugin name. Alternatively, check the plugin's main PHP file (usually jobsearch.php) for the 'Version' header comment in the file header.Affected if The installed version is 2.9.2 or lower (any version up to and including 2.9.2 is affected).
-
Verify if social login is enabledNavigate to WordPress admin > JobSearch Options > Social Login settings (or similar path under JobSearch settings). Check whether any social login networks (Xing, Google) are enabled and configured.Affected if Social login is active and connected to Xing or Google; the vulnerability exists in those callback handlers.
-
Inspect OAuth callback handlersLocate the plugin files jobsearch-xing-response.php, jobsearch-google-login.php, or similar files in the plugin directory. Search for functions named jobsearch_xing_response_data_callback, set_access_tokes (note the typo), and google_callback. Examine if these functions perform proper token validation and user session checks.Affected if The callback functions exist and lack proper token validation or user session verification before processing OAuth responses.
-
Check for suspicious admin accountsIn WordPress admin, go to Users > All Users. Review the user list for unknown administrator accounts, especially those created recently or with unusual usernames (random strings, 'admin' variations, or names matching social platforms). Cross-reference creation dates with when social login was enabled.Affected if Unexpected admin accounts exist that were created after social login was configured, indicating possible exploitation.
You are affected if the JobSearch plugin version is 2.9.2 or lower AND social login (Xing or Google) is enabled, with the OAuth callback functions lacking proper token/session validation.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scopedUpdate the JobSearch plugin to the latest version immediately and review/revoke any suspicious admin accounts or social connections; audit connected OAuth credentials and implement proper token validation and session verification.
Latest version of JobSearch WP Job Board plugin (version 2.9.3 or higher if available)
- Check the current version of the JobSearch WP Job Board plugin in your WordPress installation
- Navigate to Plugins > Installed Plugins in the WordPress admin dashboard
- If the plugin is outdated, update to the latest version available from the WordPress plugin repository or the vendor
- After updating, verify that social login functionality (Xing and Google) continues to work correctly
- Ensure no unauthorized users have been added to the site by reviewing user accounts
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation2.0 h
- Implementation2.0 h
- Testing2.0 h
- Review / QA1.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $1,984.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2024-11917 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2024-11917 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data