EUVD-2026-39768
GHSA-2wmh-hj9f-qxhx
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
Contributor authentication required (PR:L), remote low-complexity SQLi reading DB beyond plugin scope (S:C, C:H), no integrity and only limited availability impact.
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
Lifecycle Timeline
1DescriptionCVE.org
Contributor SQL Injection in WP Job Portal <= 2.5.2 versions.
AnalysisAI
SQL injection in the WP Job Portal WordPress plugin (versions 2.5.2 and earlier) lets a low-privileged Contributor-level user inject arbitrary SQL into a backend query, exposing the WordPress database. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H) reflects high confidentiality impact with a scope change, and the issue was reported by Patchstack. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Technical ContextAI
WP Job Portal is a job-board plugin for WordPress that stores listings, applications, and user data in the WordPress MySQL/MariaDB database. The flaw is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-supplied input reaches a SQL statement without proper parameterization or escaping - typically an unsanitized parameter concatenated into a query accessible from a plugin endpoint reachable by Contributor-role accounts. No CPE strings were supplied in the input; affected scope is derived solely from the version expression 'WP Job Portal <= 2.5.2' in the Patchstack-sourced description.
RemediationAI
No vendor-released patch version was identified in the provided data; consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wp-job-portal/vulnerability/wordpress-wp-job-portal-plugin-2-5-2-sql-injection-vulnerability?_s_id=cve) for the fixed release and upgrade to any version above 2.5.2 once published. Until a patched version is confirmed, reduce exposure by removing or restricting Contributor-level accounts (disable open user registration, or set the default new-user role to Subscriber), since exploitation requires that privilege level; alternatively deploy a WordPress WAF or virtual patch (Patchstack provides one) to filter SQL injection payloads against the affected plugin endpoints. Trade-offs: tightening Contributor registration limits legitimate content-submission workflows, and WAF rules may need tuning to avoid false positives on legitimate job-listing input.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today