CVE-2020-35749 EXPLOIT
7.7
HIGH · CVSS 3.1 · EPSS 30.5% (pctl 98)
Patch early
A public exploit exists.
Description
Directory traversal vulnerability in class-simple_job_board_resume_download_handler.php in the Simple Board Job plugin 2.9.3 and earlier for WordPress allows remote attackers to read arbitrary files via the sjb_file parameter to wp-admin/post.php.
Scoring
| CVSS | 7.7 (HIGH, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N |
| EPSS | 30.48% — more likely to be exploited than 98% of all CVEs |
| Weakness | CWE-22 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2021-01-15 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| presstigers | simple board job |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Wordpress Plugin Simple Job Board 2.9.3 - Local File Inclusion | 2022-02-08 |
| exploit-db | Wordpress Plugin Simple Job Board 2.9.3 - Authenticated File Read (Metasploit) | 2021-01-21 |
References
- http://packetstormsecurity.com/files/161050/Simple-JobBoard-Authenticated-File-Read.html
- http://packetstormsecurity.com/files/165892/WordPress-Simple-Job-Board-2.9.3-Local-File-Inclusion.html
- https://docs.google.com/document/d/1TbePkrRGsczepBaJptIdVRvfRrjiC5hjGg_Vxdesw6E/edit?usp=sharing
- http://packetstormsecurity.com/files/161050/Simple-JobBoard-Authenticated-File-Read.html
- http://packetstormsecurity.com/files/165892/WordPress-Simple-Job-Board-2.9.3-Local-File-Inclusion.html
- https://docs.google.com/document/d/1TbePkrRGsczepBaJptIdVRvfRrjiC5hjGg_Vxdesw6E/edit?usp=sharing
→ the Explorer · watch your stack · NVD