CVE-2026-12396: WP Job Portal missing authorization in job moderation actions

CVE-2026-12396 · Severity: info · CVSS 5.4 · Published 2026-07-13

WP Job Portal, a WordPress plugin used to manage job boards, contains a security flaw that allows low-level users to perform administrative actions. An authenticated user, such as someone registered as an employer, can approve their own job postings without oversight, grant themselves 'featured' status for free, or delete job postings belonging to competitors. This undermines the moderation process and can lead to unauthorized content changes and business disruption on the job portal.

Quick answers

Is CVE-2026-12396 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-12396 being exploited in the wild.
How severe is CVE-2026-12396?
Informational severity, with a CVSS score of 5.4, published 13 July 2026.
Which products and versions are affected?
WP Job Portal WP Job Portal < 2.5.5.
Is there a fix for CVE-2026-12396?
A patch was published on 2026-07-13: Fixed in version 2.5.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-12396 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-12396?
Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The WP Job Portal plugin for WordPress fails to implement proper authorization checks (CWE-862) in its job moderation handlers. Specifically, the 'approveQueueJob', 'approveQueueFeaturedJob', and 'rejectQueueJob' tasks within the 'wpjobportaltask' action do not verify if the requesting user has administrative privileges or ownership of the job ID provided. An authenticated attacker with a low-privileged account (such as a Subscriber or Employer role) can obtain a valid nonce from the front-end and then send direct GET requests to these endpoints. This allows the attacker to bypass moderation queues, gain 'featured' status without payment, or unpublish jobs belonging to other users. The issue is fixed in version 2.5.5.

Affected products

  • WP Job Portal WP Job Portal < 2.5.5

Timeline

  • 2026-06-22: disclosed: Publicly published by WPScan
  • 2026-07-13: advisory: NVD published date
  • 2026-07-13: patched: Fixed in version 2.5.5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.