CVE-2024-8614 is a critical vulnerability in the JobSearch WP Job Board WordPress plugin caused by the lack of file type validation in the jobsearch_wp_handle_upload() function. This allows authenticated attackers with at least subscriber privileges to upload arbitrary files to the server. Such unrestricted file upload can enable remote code execution, compromising confidentiality, integrity, and availability of the affected system. The vulnerability affects all versions up to 2.6.7. The CVSS 3.1 base score is 9.9, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official fix has been documented yet.

An attacker with subscriber-level access or higher can upload arbitrary files to the server hosting the vulnerable plugin. This can lead to remote code execution, allowing full compromise of the affected WordPress site. The vulnerability impacts confidentiality, integrity, and availability severely. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles and permissions to trusted users only and consider disabling or removing the JobSearch WP Job Board plugin if possible. Monitor for updates from the vendor and apply patches promptly once available.