Executive brief
The WP Job Portal plugin for WordPress, which provides job board functionality, contains a security flaw that allows registered users to view the private email addresses of employers. By manipulating job identification numbers, a user with a basic account can bypass security checks to harvest contact information that should remain hidden. This could lead to privacy violations and targeted phishing or spam campaigns against business users on the platform.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the WP Job Portal plugin before version 2.5.5 due to a lack of ownership verification in the 'getEmailFields' AJAX task. Authenticated users, including those with subscriber-level permissions, can obtain a valid session-bound nonce and then query the 'wpjobportal_ajax' action with arbitrary 'jobid' parameters. When a job does not have a public company contact email defined, the plugin incorrectly falls back to returning the employer's private account email address in the response. Attackers can automate this process by enumerating job identifiers to harvest a database of employer emails. The issue is fixed in version 2.5.5.
Affected products
- WP Job Portal WP Job Portal < 2.5.5
Timeline
- 2026-06-22: disclosed: Vulnerability details published by WPScan
- 2026-07-13: advisory: CVE-2026-12397 published to NVD
- 2026-07-13: patched: Fix confirmed in version 2.5.5