Wp Job Portal Ai Powered Recruitment System For Company Or Job Board Website CVE-2026-4306

WP Job Portal plugin for WordPress versions up to 2.4.8 must be installed and active. Unauthenticated remote attacker crafts malicious SQL via 'radius' parameter in vulnerable endpoint. No user interaction required. Default WordPress installations are affected.

This vulnerability presents significant real-world risk due to multiple converging factors. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates network-accessible exploitation with low complexity, no privileges required, and no user interaction needed, making it highly automatable. Unauthenticated SQL injection vulnerabilities in WordPress plugins are frequently exploited in the wild, as they provide direct database access without authentication barriers. The high confidentiality impact (C:H) means attackers can extract complete database contents including password hashes, email addresses, and potentially sensitive recruitment data. While no EPSS score or KEV status is provided in the source data, the combination of unauthenticated access, low attack complexity, and the widespread use of WordPress makes this a priority for immediate patching. The availability of proof-of-concept code can be inferred from the detailed technical references pointing to specific vulnerable code lines, lowering the barrier for exploitation.

An unauthenticated attacker identifies a WordPress site running WP Job Portal plugin version 2.4.8 or earlier through plugin enumeration. The attacker crafts a malicious HTTP request to the AJAX endpoint, injecting SQL commands into the 'radius' parameter such as appending a UNION SELECT statement to extract user credentials, email addresses, and authentication tokens from the WordPress database. Using the extracted administrator credentials, the attacker gains full control of the WordPress installation to install malicious plugins, deface the site, or pivot to other systems in the hosting environment.