CVE-2024-2036

The ApplyOnline application-form plugin for WordPress, through version 2.6.2, is missing a capability check on its aol_modal_box AJAX action. The consequence is broken access control: an authenticated user with only subscriber-level access can view application submissions they were never meant to see. There's no code execution or site takeover here — the flaw is that the door to submitted data is unlocked for the lowest tier of logged-in user.

The 4.3 score is honest about the mechanism — low privileges, confidentiality only — but the data type raises the practical stakes above what the number implies. Application form submissions routinely contain personal information: names, contact details, and whatever the form collected. On sites with open registration, a subscriber account costs an attacker nothing to obtain, which turns authenticated into a very low bar for harvesting other people's submissions.

We frame this as a privacy and data-exposure issue rather than a system-compromise one, and weight it by two factors: whether the site allows self-service registration, and how sensitive the collected submissions are. WordPress plugins are hard to inventory centrally, so we enumerate where ApplyOnline runs at 2.6.2 or below and prioritize instances with open signup and PII-bearing forms — there the low CVSS undersells the real disclosure risk.