Cyber Resilience

CVE-2024-43243

Critical

Published: 07 January 2025

Published
07 January 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0120 79.3th percentile
Risk Priority 21 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-43243 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability. Its CVSS base score is 10.0 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 20.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2024-43243 is an Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434) in the WordPress plugin JobBoard Job listing, also known as job-board-light, developed by themeglow. The flaw allows attackers to upload web shells to the web server and affects all versions from n/a through 1.2.6.

With a CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), the vulnerability is exploitable over the network by unauthenticated attackers requiring low complexity and no user interaction. Successful exploitation enables remote attackers to upload malicious files like web shells, resulting in high impacts to confidentiality, integrity, and availability, with a change in scope that amplifies the compromise to the server environment.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/job-board-light/vulnerability/wordpress-jobboard-job-listing-plugin-1-2-6-arbitrary-file-upload-vulnerability?_s_id=cve documents this arbitrary file upload vulnerability in version 1.2.6, providing details for security practitioners to assess and address exposure in affected WordPress installations.

EU & UK References

Vulnerability details

Unrestricted Upload of File with Dangerous Type vulnerability in themeglow JobBoard Job listing job-board-light allows Upload a Web Shell to a Web Server.This issue affects JobBoard Job listing: from n/a through <= 1.2.6.

CWE(s)
CWE-434

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
Why these techniques?

Arbitrary file upload vulnerability in public-facing WordPress plugin directly enables web shell deployment by unauthenticated attackers.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-46384Shared CWE-434
CVE-2025-13516Shared CWE-434
CVE-2024-13011Shared CWE-434
CVE-2025-8323Shared CWE-434
CVE-2025-21624Shared CWE-434
CVE-2026-35164Shared CWE-434
CVE-2026-2097Shared CWE-434
CVE-2025-12154Shared CWE-434
CVE-2026-42748Shared CWE-434
CVE-2025-32957Shared CWE-434

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly remediates the unrestricted file upload vulnerability by identifying, patching, and deploying fixes for the affected JobBoard plugin versions up to 1.2.6.

SI-10 Information Input Validation good match
prevent

Enforces validation of file uploads to detect and reject dangerous types like web shells, directly countering the CWE-434 flaw in the plugin.

SI-3 Malicious Code Protection good match
preventdetect

Scans uploaded files for malicious code such as web shells at network entry points and prior to execution, mitigating exploitation of the arbitrary file upload vulnerability.

References