Is CVE-2026-12395 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12395 being exploited in the wild.

How severe is CVE-2026-12395?

Informational severity, with a CVSS score of 7.7, published 16 July 2026.

Which products and versions are affected?

WP Job Portal WP Job Portal < 2.5.5.

Is there a fix for CVE-2026-12395?

A patch was published on 2026-07-16: Fixed in version 2.5.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-12395 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-12395?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12395: WP Job Portal SQL injection in Applied Resumes ta parameter

Q: Is there a fix for CVE-2026-12395?

A patch was published on 2026-07-16: Fixed in version 2.5.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-12395 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-12395?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12395 · Severity: info · CVSS 7.7 · Published 2026-07-16

WP Job Portal is a WordPress plugin used to manage job listings and applications. A security flaw allows registered users, such as job seekers, to execute unauthorized database commands. This could lead to the theft of sensitive user data, modification of site content, or full compromise of the website's database.

Quick answers

Is CVE-2026-12395 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12395 being exploited in the wild.
How severe is CVE-2026-12395?: Informational severity, with a CVSS score of 7.7, published 16 July 2026.
Which products and versions are affected?: WP Job Portal WP Job Portal < 2.5.5.
Is there a fix for CVE-2026-12395?: A patch was published on 2026-07-16: Fixed in version 2.5.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-12395 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-12395?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability exists in the WP Job Portal plugin for WordPress due to insufficient sanitization and escaping of the 'ta' parameter within the Applied Resumes functionality. The flaw allows authenticated users with subscriber-level privileges (which are often self-registerable) to inject arbitrary SQL commands into backend queries. This can result in unauthorized data extraction, modification, or deletion from the WordPress database. The issue is fixed in version 2.5.5.

Affected products

WP Job Portal WP Job Portal < 2.5.5

Timeline

2026-06-25: disclosed: Publicly published by WPScan
2026-07-16: advisory: NVD publication date
2026-07-16: patched: Fixed in version 2.5.5

References

https://wpscan.com/vulnerability/0183c669-cb09-4d53-852f-a0a877691d1e/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.