WP Job Portal CVE-2026-12395

Requires an authenticated subscriber-level WordPress account on the target site. The critical nuance is that WP Job Portal sites commonly enable self-registration to allow job seekers to create accounts, meaning any external attacker can obtain the required credentials by registering freely - no social engineering or credential theft is needed. Sites where WordPress user registration has been administratively disabled (Settings > General) are protected from external exploitation, limiting the attack surface to users who already hold a legitimate registered account. No specific plugin configuration, non-default setting, or special feature toggle is required beyond having the plugin active and user registration open. CVSS vector PR:L/UI:N confirms exploitation requires no victim interaction once the attacker holds a subscriber account.

CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately reflects the read-only, low-privilege network attack profile. The PR:L (low-privilege) requirement is partially offset by subscriber self-registration being openly available, meaning any internet-accessible WordPress site running this plugin with open registration is effectively exploitable by an unauthenticated outsider who spends seconds creating an account. The impact ceiling is database confidentiality - WordPress credentials, PII stored in job applications, and other table contents - but no direct write or denial-of-service path is evident from available data. EPSS at 0.18% (7th percentile) is low despite a public exploit, which may reflect that mass scanning tools have not yet widely integrated this payload, or that the niche install base limits opportunity. No KEV listing means active exploitation has not been confirmed by CISA. The combination of a public exploit and self-registerable prerequisite warrants prompt patching even though EPSS signal is weak.

An attacker visits a WordPress site running WP Job Portal before 2.5.5, registers a free subscriber account via the standard WordPress registration page, then issues a crafted HTTP request with a SQL injection payload in the vulnerable parameter. Using the publicly available exploit code documented by WPScan, the attacker iterates through the WordPress database extracting user table contents - including bcrypt-hashed admin passwords - which can then be subjected to offline cracking.