WP Job Portal CVE-2026-12396

Exploitation requires an authenticated subscriber-level session on the target WordPress site; because the subscriber role is self-registerable by default on WordPress (when 'Anyone can register' is enabled), no pre-existing credentials or social engineering are needed. The target site must be running WP Job Portal in any version prior to 2.5.5 with the plugin active. No special plugin configuration beyond default installation is required - the missing check exists on standard job moderation actions available in the default plugin feature set. Exploitation is bounded by the following limiting factors: the site must have open user registration enabled (not all WordPress sites do); impact is strictly confined to job listing state manipulation (approve/feature/reject) with no path to code execution, file access, or privilege escalation; and the attacker must know or discover the moderation endpoint, though the public POC provides this.

The CVSS 5.4 Medium score (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) accurately captures the limited blast radius: no confidentiality loss, and integrity and availability impacts are constrained to job listing states rather than broader WordPress data or infrastructure. However, the practical exploitability is elevated beyond the medium score by two factors: subscriber accounts are self-registerable by default on many WordPress installations (removing any credential barrier), and a publicly available POC lowers the skill threshold to near zero. The absence of a CISA KEV listing suggests exploitation has not reached confirmed mass-exploitation status, though WPScan's disclosure with a public exploit makes opportunistic targeting plausible. No EPSS score was provided in the intelligence data. Real-world risk is highest for sites operating active job boards where moderation disruption - suppressing legitimate listings, amplifying spam, or manipulating featured placements - could have direct business impact. No conflicting signals were identified between the CVSS vector and the described vulnerability behavior.

An attacker visits the target WordPress site, self-registers a subscriber account using the open registration form, and authenticates. Using the publicly available proof-of-concept against the job moderation endpoint, they send crafted authenticated HTTP requests to approve spam employer listings, feature attacker-controlled job postings in premium placement, or systematically reject legitimate job submissions from competing employers - all without owning or having any legitimate administrative relationship to the affected listings.