WP Job Portal EUVD-2026-33909

No special conditions - remote unauthenticated exploitation against default configurations of the WP Job Portal plugin (versions through 2.5.1) on any internet-reachable WordPress site that has the plugin installed and activated. Per the CVSS vector PR:N/UI:N/AV:N/AC:L, no authentication, user interaction, or non-default settings are required, and the attacker only needs HTTP/HTTPS access to a vulnerable plugin endpoint. The principal limiting factor is plugin presence and activation: sites without WP Job Portal installed, or with the plugin deactivated, are not exposed, and the impact is bounded to data disclosure (C:H, I:N) rather than direct database modification according to the Patchstack-supplied CVSS metrics.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) indicates the highest-tier reachability profile: network-exploitable, low complexity, no authentication, no user interaction, with scope change and high confidentiality impact - consistent with unauthenticated extraction of sensitive WordPress database contents (user hashes, session tokens, PII from job applications). However, EPSS data is not provided in the input, so probability of exploitation in the wild cannot be quantified, and the vulnerability is not on the CISA KEV list, indicating no confirmed active exploitation. The C:H / I:N / A:L breakdown is unusual for SQLi (typically I:H as well) and suggests Patchstack assessed the injection point as read-only or limited to specific query contexts - defenders should treat this as data-theft risk rather than full database tampering, though blind SQLi often still enables enumeration of administrative credentials that lead to fuller compromise.

An unauthenticated attacker identifies a WordPress site running WP Job Portal 2.5.1 or earlier and sends HTTP requests containing crafted SQL payloads to a vulnerable plugin parameter (for example a job search, filter, or AJAX handler). Because the injection is blind, the attacker uses time-based or boolean-based inference (e.g., conditional SLEEP() or true/false response differentials) to enumerate the database schema and exfiltrate wp_users password hashes and other sensitive job-applicant data row by row. No public exploit code is identified at this time, but the low complexity and absence of authentication mean a working PoC is straightforward for any attacker familiar with sqlmap.