WP Job Portal CVE-2026-12397

Exploitation requires the attacker to hold a subscriber-level WordPress account on the target site; subscriber registration must be open to the public (a common default on job board sites built with this plugin). The WP Job Portal plugin must be installed and running a version below 2.5.5. The attacker must be able to enumerate or guess valid job listing identifiers, which are typically sequential integers - a trivial task. Exploitation is limited by the non-automatable SSVC flag, suggesting some friction exists (e.g., session validation, rate limiting, or token-based requests that prevent fully scripted bulk enumeration without interaction). Impact is bounded to the disclosure of employer email addresses only - no write access, no session compromise, no server-side code execution is possible through this flaw.

The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) accurately reflects a low-complexity, network-accessible attack requiring only a subscriber account, with impact limited to confidentiality of email data. The EPSS score of 0.13% in the 3rd percentile indicates very low observed exploitation probability at time of analysis. SSVC classifies exploitation as 'poc' (proof-of-concept available, not actively weaponized), the attack as non-automatable, and technical impact as partial - these signals align with a moderate-priority advisory rather than an emergency. The primary aggravating factor is the low barrier to entry: subscriber accounts are self-registerable, meaning any external attacker can trivially obtain the required authentication. The primary limiting factor is impact scope - only employer email addresses are disclosed, not credentials, session tokens, or application data. No CISA KEV listing confirms active exploitation at time of analysis. Real-world risk is proportional to the sensitivity of the employer email dataset and the likelihood that exposed emails will enable downstream attacks such as phishing or credential stuffing.

An attacker visits a WordPress job board site running WP Job Portal before 2.5.5, registers a free subscriber account using any valid email address, and then sends a series of authenticated HTTP requests to the plugin's employer-email lookup endpoint while incrementing the job identifier parameter. For each valid job ID, the server returns the corresponding employer's private contact email without verifying that the requester has any right to that data. A publicly available proof-of-concept demonstrates this enumeration technique, enabling bulk harvesting of employer emails for downstream phishing or spam campaigns.