What is the CVSS score of CVE-2026-23806?

CVE-2026-23806 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Jobs For Wordpress are affected by CVE-2026-23806?

CVE-2026-23806 presents notable security risk, a missing authorization vulnerability rated CVSS 7.5.

How to fix or mitigate CVE-2026-23806?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

Jobs For Wordpress CVE-2026-23806

EUVD-2026-15542 HIGH

Missing Authorization (CWE-862)

2026-03-25 Patchstack

GHSA-m5pg-39xw-rv4g

WordPress Authentication Bypass Jobs For Wordpress Wordpress Plugin

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15542

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 7.5

DescriptionCVE.org

Missing Authorization vulnerability in BlueGlass Interactive AG Jobs for WordPress job-postings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Jobs for WordPress: from n/a through <= 2.8.

AnalysisAI

A missing authorization vulnerability exists in BlueGlass Interactive AG's Jobs for WordPress plugin (versions up to 2.8) that allows attackers to bypass access control mechanisms through incorrectly configured security levels. This vulnerability (CWE-862: Missing Authorization) could permit unauthenticated or low-privileged attackers to access job posting functionality intended to be restricted to authorized users. While no CVSS score, EPSS data, or confirmed public exploit has been published, the straightforward nature of authorization bypass flaws and the plugin's widespread WordPress deployment make this a moderate-to-high priority for administrators managing job posting systems.

Technical ContextAI

The vulnerability resides in the Jobs for WordPress plugin (CPE: cpe:2.3:a:blueglass_interactive_ag:jobs_for_wordpress:*:*:*:*:*:*:*:*), which extends WordPress functionality to manage job postings. The root cause is classified under CWE-862 (Missing Authorization), indicating that the plugin fails to enforce proper capability checks or role-based access control before allowing actions on job posting resources. WordPress plugins typically control access via capabilities (e.g., edit_posts, publish_posts) verified through wp_current_user_can() or similar hooks. The misconfiguration suggests that job posting endpoints or administrative functions lack these authorization checks, allowing requests from users without the intended privileges to proceed unchallenged.

RemediationAI

Immediately upgrade Jobs for WordPress to a version later than 2.8 once a patched release is available from BlueGlass Interactive AG; monitor the Patchstack database and the plugin's WordPress.org repository for security updates. Until patching is deployed, administrators should restrict access to job posting management pages by implementing WordPress user role restrictions—ensure only trusted administrators with the edit_posts capability can manage job listings, and audit existing job postings for unauthorized modifications. Implement WordPress security hardening measures such as enforcing strong authentication (two-factor authentication via plugins like Wordfence), limiting login attempts, and disabling direct file access to the plugin directory via .htaccess rules (deny direct access to /wp-content/plugins/job-postings/). Consider temporarily disabling the plugin if it is not actively in use. Monitor access logs for suspicious requests to job posting endpoints.