EUVD-2026-43292
GHSA-9j4j-jqwp-qxc9
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Subscriber account (self-registerable) satisfies PR:L; only employer email addresses disclosed limits impact to C:L; no integrity or availability impact applies.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The WP Job Portal WordPress plugin before 2.5.5 does not verify ownership when returning an employer's contact email for a given job, allowing authenticated users with a subscriber-level (self-registerable) account to read other employers' private account email addresses by enumerating job identifiers.
AnalysisAI
Information disclosure in the WP Job Portal WordPress plugin before version 2.5.5 allows any authenticated subscriber-level user - accounts that are self-registerable - to harvest private contact email addresses belonging to other employers by cycling through job listing identifiers. The plugin endpoint that returns an employer's contact email for a given job fails to verify that the requesting user has any ownership or access rights to that record, making this a classic IDOR (Insecure Direct Object Reference) flaw. Publicly available exploit code exists per WPScan; however, EPSS remains very low at 0.13% (3rd percentile) and the attack is not listed in CISA KEV, suggesting exploitation is not yet widespread.
Technical ContextAI
WP Job Portal is a WordPress plugin (CPE: cpe:2.3:a:unknown:wp_job_portal:*:*:*:*:*:*:*:*) designed to enable job board functionality within WordPress sites. The vulnerability stems from a missing authorization check - specifically, the plugin exposes an endpoint (or function) that accepts a job identifier as input and returns the associated employer's contact email address. Because the code does not validate whether the authenticated requester is the owner of or has legitimate access to that specific job record, any user who can authenticate (including self-registered subscribers) can supply arbitrary job IDs and retrieve corresponding employer emails. The CWE taxonomy entry was not assigned in this advisory, but the mechanism is consistent with CWE-639 (Authorization Bypass Through User-Controlled Key) or CWE-284 (Improper Access Control). The attack surface is the authenticated WordPress session layer, leveraging predictable or sequential integer job identifiers.
RemediationAI
The primary remediation is to update the WP Job Portal plugin to version 2.5.5 or later, which introduces the missing ownership verification check on the employer email endpoint. WordPress site administrators should apply this update immediately via the WordPress plugin dashboard or by downloading the patched release. The vendor advisory is documented at https://wpscan.com/vulnerability/8e797251-2351-4979-a6c1-c05c78622327/. If immediate patching is not feasible, a compensating control is to disable self-registration of subscriber-level accounts (Settings > General > 'Anyone can register') to raise the barrier for unauthenticated external attackers - note this may impact legitimate job seeker sign-ups and does not eliminate risk from already-registered accounts. Additionally, site owners should consider whether employer contact emails need to be accessible via this endpoint at all, and if not, restricting the relevant endpoint via a WAF rule or plugin-level configuration until the patch is applied.
More in Wp Job Portal
View allThe WP Job Portal WordPress plugin before 2.0.6 does not sanitise and escape a parameter before using it in a SQL statem
SQL injection in WP Job Portal WordPress plugin before 2.5.5 enables authenticated subscriber-level users to exfiltrate
The WP Job Portal - A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to
The WP Job Portal - A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to
Missing authorization in WP Job Portal WordPress plugin before 2.5.5 allows any self-registered subscriber to approve, f
A SQL injection vulnerability in wpjobportal WP Job Portal allows Blind SQL Injection (CVSS 9.3). Critical severity with
Blind SQL injection in the WP Job Portal WordPress plugin (versions up to and including 2.5.1) allows remote unauthentic
SQL injection in the WP Job Portal WordPress plugin (versions up to and including 2.5.6) is exploitable by any authentic
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in wpjobportal WP Job Porta
Path Traversal vulnerability in wpjobportal WP Job Portal allows PHP Local File Inclusion.2.8. Rated high severity (CVSS
The WP Job Portal - A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today