CVE-2026-12396
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The WP Job Portal WordPress plugin before version 2.5.5 does not perform capability or ownership checks before allowing job moderation actions, allowing authenticated users with a subscriber-level (self-registerable) account to approve, feature, or reject arbitrary jobs, including those owned by other users.
Risk Assessment
The risk is that ordinary users can perform unauthorized job moderation, potentially leading to data integrity breaches, disruption of recruitment processes, and possible exploitation to promote fake or malicious job listings.
Recommendation
Immediately update the WP Job Portal plugin to version 2.5.5 or later, which includes necessary security fixes that check permissions and ownership before executing moderation actions.
Other vulnerabilities in WP Job Portal
See all- CVE-2026-57653High
The WP Job Portal plugin version 2.5.2 and earlier contains a SQL injection vulnerability in the Contributor module. This allows an attacker to manipulate database queries.
- CVE-2026-42684Critical
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ahmad WP Job Portal allows Blind SQL Injection. This issue affects WP Job Portal from n/a through 2.5.1.
- CVE-2026-81299Medium
The WP Job Portal plugin in versions 2.5.9 and earlier has an Insecure Direct Object References (IDOR) vulnerability for subscribers. Subscriber-level users can access objects (e.g., data) without authorization.
- CVE-2026-65569High
Subscriber SQL Injection in WP Job Portal versions up to 2.5.6.
- CVE-2026-12395Medium
The WP Job Portal WordPress plugin before version 2.5.5 fails to properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with a subscriber-level (self-registerable) account to perform SQL injection attacks.
- CVE-2026-12397Medium
The WP Job Portal WordPress plugin before version 2.5.5 does not verify ownership when returning an employer's contact email for a given job, allowing authenticated users with a subscriber-level (self-registerable) account to read other employers' private account email addresses by enumerating job identifiers.
- CVE-2026-48880Medium
The WP Job Portal plugin versions up to 2.5.2 contain a Cross Site Scripting (XSS) vulnerability that can be exploited by subscribers.
- CVE-2026-42685High
The WP Job Portal plugin by Ahmad versions up to 2.5.1 has a Reflected XSS vulnerability due to improper input neutralization during page generation. An attacker can inject malicious script via a crafted URL, which executes in the victim's browser.
Original NVD description (English source)
The WP Job Portal WordPress plugin before 2.5.5 does not perform capability or ownership checks before allowing job moderation actions, allowing authenticated users with a subscriber-level (self-registerable) account to approve, feature, or reject arbitrary jobs, including those owned by other users.