What is the CVSS score of CVE-2026-24379?

CVE-2026-24379 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Wordpress Plugin are affected by CVE-2026-24379?

WP Job Portal contains a critical authorization bypass vulnerability (CVSS 9.1) that allows attackers to bypass access controls and potentially gain unauthorized access to sensitive job posting and…

How to fix or mitigate CVE-2026-24379?

Within 24 hours: Disable the WP Job Portal plugin immediately and assess whether applicant data has been accessed or exfiltrated; notify legal and communications teams of the risk. Within 7 days: Evaluate alternative recruitment platforms, perform forensic analysis of access logs, and rotate credentials for accounts with plugin administrative access. Within 30 days: Migrate to a patched version once available from the vendor, conduct a full security audit of recruitment systems, and implement enhanced monitoring controls for job portal functionality.

Wordpress Plugin CVE-2026-24379

MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-01-22 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Severity Changed

Apr 23, 2026 - 15:43 NVD

CRITICAL MEDIUM

CVSS changed

Apr 23, 2026 - 15:43 NVD

9.1 (CRITICAL) 6.5 (MEDIUM)

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 22, 2026 - 17:16 nvd

CRITICAL 9.1

DescriptionCVE.org

Authorization Bypass Through User-Controlled Key vulnerability in wpjobportal WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through <= 2.4.3.

AnalysisAI

WP Job Portal has an authorization bypass through user-controlled keys allowing attackers to access other users' job applications and employer data.

Technical ContextAI

The WP Job Portal plugin has a CWE-639 authorization bypass through user-controlled key vulnerability, commonly known as Insecure Direct Object Reference (IDOR), allowing attackers to access other users' data by manipulating identifiers.