What is CVE-2024-13698?

CVE-2024-13698 is a medium-severity vulnerability in Astoundify Jobify, classified under Missing Authorization. CVSS score: 6.5/10. Published 2025-01-24.

How severe is CVE-2024-13698?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Auth bypass in Astoundify Jobify

CVE-2024-13698

The Jobify - Job Board WordPress Theme for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the 'download_image_via_ai' and 'generate_image_via_ai' functions in all versions up to, and including, 4.2.7. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application to upload files in an image format, and to generate AI images using the site's OpenAI key.

Vulnerability class: Broken Access Control

EPSS: 0.003 (24.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N.

Affected products

Astoundify Jobify
Astoundify Jobify - Job Board Wordpress Theme — versions 0

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

security@wordfence.com (Third Party Advisory)
security@wordfence.com (Product)

Frequently asked questions

What is CVE-2024-13698?: CVE-2024-13698 is a medium-severity vulnerability in Astoundify Jobify, classified under Missing Authorization. CVSS score: 6.5/10. Published 2025-01-24.
How severe is CVE-2024-13698?: Medium severity. CVSS v3 base score is 6.5 out of 10.