What is the CVSS score of CVE-2026-42684?

CVE-2026-42684 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of WP Job Portal are affected by CVE-2026-42684?

WP Job Portal WordPress plugin (versions ≤2.5.1) contains a critical blind SQL injection vulnerability (CVSS 9.3) exploitable by unauthenticated remote attackers without user interaction, potentially…

How to fix or mitigate CVE-2026-42684?

24 hours: Identify all WordPress instances running WP Job Portal plugin versions 2.5.1 and earlier; disable or uninstall the plugin as immediate containment. 7 days: Deploy Web Application Firewall (WAF) rules to block SQL injection patterns targeting vulnerable parameters; enable database query logging and alerts for anomalous activity. 30 days: Confirm patch availability from plugin vendor; if unavailable, evaluate alternative job portal solutions or implement permanent mitigation via strict input validation and prepared statement enforcement.

WP Job Portal CVE-2026-42684

EUVD-2026-33909 CRITICAL

SQL Injection (CWE-89)

2026-06-02 Patchstack

GHSA-6m39-555m-v725

WordPress SQLi Wp Job Portal Wordpress Plugin Ahmad

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 11:50 vuln.today

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ahmad WP Job Portal allows Blind SQL Injection.

This issue affects WP Job Portal: from n/a through 2.5.1.

AnalysisAI

Blind SQL injection in the WP Job Portal WordPress plugin (versions up to and including 2.5.1) allows remote unauthenticated attackers to manipulate backend database queries by sending crafted input to vulnerable parameters. The flaw carries a CVSS 9.3 rating due to network-reachable, no-privileges, no-user-interaction exploitation with scope change, and no public exploit code has been identified at time of analysis. The vulnerability was reported through Patchstack's WordPress security program, with no CISA KEV listing.

Technical ContextAI

WP Job Portal is a job board and recruitment plugin for WordPress developed by Ahmad, used to publish job listings, manage applications, and handle candidate/employer accounts on WordPress sites (CPE: cpe:2.3:a:ahmad:wp_job_portal). The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-controlled input is concatenated or interpolated into SQL statements without parameterization or proper escaping through WordPress's $wpdb->prepare() facility. The 'blind' qualifier indicates the application does not return query results or verbose database errors directly, so exploitation typically relies on boolean-based or time-based inference techniques to extract data byte by byte.

RemediationAI

No vendor-released patch identified at time of analysis - the Patchstack advisory documents the issue against the 2.5.1 version with no fixed version cited in the provided data, so administrators should monitor the WP Job Portal plugin page on WordPress.org and the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wp-job-portal/vulnerability/wordpress-wp-job-portal-plugin-2-5-1-sql-injection-vulnerability) for an updated release beyond 2.5.1 and upgrade as soon as it ships. Until a patched build is available, deactivate the WP Job Portal plugin on production sites that do not actively serve a job board (this removes all plugin endpoints), or place the site behind a WAF / Patchstack mitigation rule that blocks SQL meta-characters and time-based payloads (UNION, SLEEP, BENCHMARK, --, etc.) on the plugin's front-end and admin-ajax endpoints - note that aggressive WAF rules can break legitimate searches containing apostrophes or quotes in job titles. Restricting access to the plugin's URLs to authenticated users via web-server rules is another option but only if the affected endpoints are not required for public job seekers, since this would break the public job board functionality.