WP Job Portal CVE-2026-81299

Exploitation requires a valid subscriber-level (or equivalent low-privilege) WordPress account on the target site, as confirmed by the CVSS PR:L metric and the vulnerability title explicitly naming 'Subscriber' IDOR. Sites that allow open user registration - common for job portals where applicants self-register - provide the easiest entry point. Sites that disable public registration or require manual admin approval significantly reduce exposure, as an attacker must otherwise obtain credentials through separate means. The unchanged scope (S:U) and integrity-only impact (I:L, C:N, A:N) constrain exploitation to unauthorized modification of WP Job Portal plugin objects; this does not escalate to WordPress core administration or server-level access. The CVSS vector does not indicate any special server-side configuration is required beyond a standard plugin installation.

The CVSS 3.1 score of 4.3 (Medium) is internally consistent: the attack is network-accessible (AV:N), low complexity (AC:L), requires a subscriber account (PR:L), needs no user interaction (UI:N), and produces only integrity impact (I:L) within an unchanged scope. No EPSS data was provided in the input, and the vulnerability is absent from the CISA KEV catalog, indicating no confirmed active exploitation. No public proof-of-concept has been identified. The bounded impact (C:N, A:N) suggests that an attacker cannot exfiltrate data or deny service through this vector alone; however, IDOR flaws on job portal platforms carry meaningful real-world risk because they can allow applicants to withdraw or tamper with competitors' applications or employers' listings. The Medium CVSS score is appropriate, but the practical impact depends heavily on what specific object types are reachable - a detail not fully specified in available data.

An attacker registers a free subscriber account on a WordPress site running WP Job Portal, then intercepts or crafts HTTP requests containing job application or listing object IDs. By incrementing or fuzzing these numeric identifiers, the attacker identifies objects owned by other users and submits modification requests - such as altering or withdrawing another applicant's submission - which the server processes without verifying ownership. No public proof-of-concept has been identified, but the low attack complexity (AC:L) means this requires no specialized tooling beyond a browser or HTTP proxy.