What is the CVSS score of CVE-2026-65569?

CVE-2026-65569 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of WP Job Portal are affected by CVE-2026-65569?

Organizations using WP Job Portal WordPress plugin versions 2.5.6 and earlier face significant data exposure from a SQL injection vulnerability accessible to any registered user; no active…

How to fix or mitigate CVE-2026-65569?

Within 24 hours, enumerate all WordPress installations running WP Job Portal and document current plugin versions; restrict new user registration where operationally feasible, or implement Web Application Firewall rules to detect and block SQL injection attempts targeting the plugin. Within 7 days, contact the plugin vendor to obtain patch timeline and release date estimates, and conduct a detailed impact assessment documenting what sensitive data would be exposed through database-wide access. Within 30 days, either migrate to an alternative job portal plugin meeting your functional requirements, or establish continuous monitoring of database queries and access logs from subscriber accounts, with regular review for suspicious activity and monitoring of the vendor's security advisory channel for patch availability.

WP Job Portal CVE-2026-65569

EUVD-2026-53987 HIGH

SQL Injection (CWE-89)

2026-08-06 Patchstack

GHSA-m439-vfmc-2fm8

WordPress SQLi Wp Job Portal Wordpress Plugin Wpjobportal

8.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

9.1 CRITICAL

Network SQLi at subscriber privilege (PR:L) with scope change; I:L added as most SQL injection paths permit at least limited data manipulation.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:H/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:51 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

HIGH 8.5

DescriptionCVE.org

Subscriber SQL Injection in WP Job Portal <= 2.5.6 versions.

AnalysisAI

SQL injection in the WP Job Portal WordPress plugin (versions up to and including 2.5.6) is exploitable by any authenticated subscriber-level user, the lowest WordPress role available to registered users. The CVSS scope change (S:C) indicates the injection escapes the plugin's own query context and can reach the broader WordPress database, yielding high confidentiality impact against data owned by other plugins or core tables. No public exploit code or CISA KEV listing exists at time of analysis, but the low authentication bar significantly lowers the effective exploitation threshold on sites with open user registration.

Technical ContextAI

WP Job Portal is a WordPress plugin (CPE: cpe:2.3:a:wpjobportal:wp_job_portal:*:*:*:*:*:*:*:*) that provides job listing and application management functionality on WordPress sites. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning at least one subscriber-accessible code path incorporates user-supplied input directly into a SQL query without parameterized statements or adequate escaping. The CVSS scope change metric (S:C) is significant: it indicates the injected query can access database tables beyond those owned by the plugin itself, including WordPress core tables (wp_users, wp_usermeta) and tables belonging to other installed plugins, effectively giving the attacker a cross-component database read primitive. The vulnerability was discovered and reported by Patchstack.

RemediationAI

The primary remediation is to update the WP Job Portal plugin to the version that addresses this vulnerability, which will be listed in the official Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp-job-portal/vulnerability/wordpress-wp-job-portal-plugin-2-5-6-sql-injection-vulnerability - the exact patched release version is not confirmed in available data at time of analysis. If an immediate update is not possible, the most effective compensating control is to disable WordPress user registration (Settings > General > uncheck 'Anyone can register'), which removes the trivially obtainable subscriber account that enables exploitation; the trade-off is that legitimate user self-registration will be blocked. Alternatively, site administrators can restrict the subscriber role from accessing the specific vulnerable WP Job Portal feature using a capability management plugin, though identifying the exact vulnerable endpoint requires reviewing the Patchstack disclosure. Enabling a web application firewall (WAF) rule targeting SQL injection payloads in POST/GET parameters is a lower-confidence secondary control. Database user privilege restriction (ensuring the WordPress DB user cannot read sensitive tables) would limit blast radius but not prevent exploitation.