Executive brief
WP Job Portal, a WordPress plugin used to manage job boards, contains a security flaw that allows low-level users to perform administrative actions. An authenticated user, such as someone registered as an employer, can approve their own job postings without oversight, grant themselves 'featured' status for free, or delete job postings belonging to competitors. This undermines the moderation process and can lead to unauthorized content changes and business disruption on the job portal.
Technical details
The WP Job Portal plugin for WordPress fails to implement proper authorization checks (CWE-862) in its job moderation handlers. Specifically, the 'approveQueueJob', 'approveQueueFeaturedJob', and 'rejectQueueJob' tasks within the 'wpjobportaltask' action do not verify if the requesting user has administrative privileges or ownership of the job ID provided. An authenticated attacker with a low-privileged account (such as a Subscriber or Employer role) can obtain a valid nonce from the front-end and then send direct GET requests to these endpoints. This allows the attacker to bypass moderation queues, gain 'featured' status without payment, or unpublish jobs belonging to other users. The issue is fixed in version 2.5.5.
Affected products
- WP Job Portal WP Job Portal < 2.5.5
Timeline
- 2026-06-22: disclosed: Publicly published by WPScan
- 2026-07-13: advisory: NVD published date
- 2026-07-13: patched: Fixed in version 2.5.5