EUVD-2026-43291
GHSA-xxgv-vhqj-mqwq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Network endpoint exploitable by any subscriber (PR:L, AC:L); scope unchanged, no confidentiality loss, only limited integrity and availability impact on job listing states.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The WP Job Portal WordPress plugin before 2.5.5 does not perform capability or ownership checks before allowing job moderation actions, allowing authenticated users with a subscriber-level (self-registerable) account to approve, feature, or reject arbitrary jobs, including those owned by other users.
AnalysisAI
Missing authorization in WP Job Portal WordPress plugin before 2.5.5 allows any self-registered subscriber to approve, feature, or reject arbitrary job listings owned by other users, bypassing both capability and ownership checks entirely. The subscriber role is self-registerable on most WordPress sites, meaning an unauthenticated attacker can trivially obtain the access level needed to exploit this flaw with no admin interaction required. A publicly available proof-of-concept exists; no CISA KEV listing indicates confirmed mass exploitation at time of analysis.
Technical ContextAI
WP Job Portal is a WordPress plugin providing job board functionality including employer and candidate management, job listings, and moderation workflows. The vulnerability is rooted in a missing authorization control - consistent with CWE-862 (Missing Authorization) - on job moderation action handlers (approve, feature, reject). WordPress enforces access control through a capability system tied to user roles, but the plugin fails to invoke capability checks (e.g., current_user_can()) or verify job post ownership before processing moderation requests. The affected CPE is cpe:2.3:a:unknown:wp_job_portal:*:*:*:*:*:*:*:* covering all versions prior to 2.5.5. The CVSS vector AV:N/AC:L/PR:L/UI:N confirms the flaw is network-reachable with low complexity and requires only low-privileged (subscriber-level) access, consistent with a REST or admin-ajax endpoint lacking a nonce/capability gate.
RemediationAI
Upgrade WP Job Portal to version 2.5.5 or later, which implements proper capability and ownership checks on all job moderation actions. The patch is confirmed available per the WPScan advisory at https://wpscan.com/vulnerability/13d574ea-84fe-421b-b1e4-23f94e2000d7/. If immediate patching is not feasible, disable open user registration on the WordPress site (Settings > General > uncheck 'Anyone can register') to eliminate the self-registration vector that makes obtaining subscriber credentials trivial - note this will block legitimate user self-onboarding and may require an alternative user provisioning workflow. A secondary compensating control is to use a WordPress capability manager plugin (e.g., User Role Editor) to explicitly strip job moderation capabilities from the subscriber role; however, this approach is fragile and may be overridden on plugin update. Neither workaround is a substitute for the vendor patch and both should be treated as temporary mitigations only.
More in Wp Job Portal
View allThe WP Job Portal WordPress plugin before 2.0.6 does not sanitise and escape a parameter before using it in a SQL statem
SQL injection in WP Job Portal WordPress plugin before 2.5.5 enables authenticated subscriber-level users to exfiltrate
The WP Job Portal - A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to
The WP Job Portal - A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to
A SQL injection vulnerability in wpjobportal WP Job Portal allows Blind SQL Injection (CVSS 9.3). Critical severity with
Blind SQL injection in the WP Job Portal WordPress plugin (versions up to and including 2.5.1) allows remote unauthentic
SQL injection in the WP Job Portal WordPress plugin (versions up to and including 2.5.6) is exploitable by any authentic
Information disclosure in the WP Job Portal WordPress plugin before version 2.5.5 allows any authenticated subscriber-le
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in wpjobportal WP Job Porta
Path Traversal vulnerability in wpjobportal WP Job Portal allows PHP Local File Inclusion.2.8. Rated high severity (CVSS
The WP Job Portal - A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today