WP Job Portal CVE-2026-65569

Requires a valid WordPress subscriber-level (or higher) account on the target site. Subscriber accounts are the lowest authenticated role and are granted automatically when WordPress user registration is open (a common configuration on job portal sites, which by nature invite candidate registrations). If user registration is disabled and no other credential-obtaining path exists, an attacker must obtain subscriber credentials through other means (phishing, credential stuffing). The scope change (S:C) applies once the injection is triggered, meaning no additional configuration is required to reach cross-plugin database tables - the expanded database read access is a consequence of the injection itself, not a separate condition. Exploitation is limited by: (1) requiring at least one valid authenticated session, (2) being constrained to confidentiality and limited availability impact per the CVSS vector (no confirmed integrity/write path from available data), and (3) requiring the WP Job Portal plugin to be installed and active.

The CVSS 8.5 High score is driven primarily by the network attack vector (AV:N), low attack complexity (AC:L), low privilege requirement (PR:L, subscriber), and the scope change yielding high confidentiality impact (C:H). The subscriber role is granted automatically on most WordPress sites that permit registration, meaning the effective barrier to exploitation is often just filling out a registration form. No EPSS score was provided in the available intelligence, so exploitation probability cannot be quantified probabilistically. No CISA KEV listing exists and no POC is referenced, suggesting no confirmed widespread exploitation at time of analysis. The combination of a high CVSS, a trivially obtainable privilege level, and a very large global WordPress deployment base makes this a genuine remediation priority for sites running WP Job Portal with user registration enabled - despite the absence of confirmed active exploitation. The I:N integrity metric in the provided CVSS vector warrants independent verification; many SQL injection paths also permit limited data writes, and the actual scope of write access should be confirmed from the vendor advisory.

An attacker registers a free subscriber account on a WordPress site running WP Job Portal 2.5.6 or earlier, then submits a crafted HTTP request containing a SQL injection payload through a subscriber-accessible plugin endpoint. The unsanitized input is interpolated into a backend SQL query, enabling UNION-based or error-based extraction of data from the WordPress database including the wp_users table, exposing hashed passwords and email addresses for all site users. No public POC has been identified at time of analysis, but the low complexity and well-understood nature of SQL injection make independent exploitation straightforward for an attacker familiar with WordPress internals.