Is CVE-2026-57653 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57653 being exploited in the wild.

How severe is CVE-2026-57653?

High severity, with a CVSS score of 8.5, published 26 June 2026.

Which products and versions are affected?

wpjobportal WP Job Portal <= 2.5.2.

Is there a fix for CVE-2026-57653?

A patch was published on 2026-06-26: Patch released in version 2.5.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57653 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-57653?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57653: wpjobportal WP Job Portal SQL injection

Q: Is there a fix for CVE-2026-57653?

A patch was published on 2026-06-26: Patch released in version 2.5.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-57653 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-57653?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57653 · Severity: high · CVSS 8.5 · Published 2026-06-26

WP Job Portal is a WordPress plugin used to create and manage job boards. A security vulnerability in versions 2.5.2 and earlier allows users with 'Contributor' level access to perform unauthorized database queries. This could lead to the theft of sensitive information from the website's database or disruption of site operations.

Quick answers

Is CVE-2026-57653 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57653 being exploited in the wild.
How severe is CVE-2026-57653?: High severity, with a CVSS score of 8.5, published 26 June 2026.
Which products and versions are affected?: wpjobportal WP Job Portal <= 2.5.2.
Is there a fix for CVE-2026-57653?: A patch was published on 2026-06-26: Patch released in version 2.5.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57653 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-57653?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability exists in the WP Job Portal plugin for WordPress (versions <= 2.5.2) due to improper neutralization of special elements used in SQL commands (CWE-89). The flaw allows an authenticated attacker with Contributor-level privileges to execute arbitrary SQL queries against the backend database. This is achieved via a network-based attack vector with low complexity. Successful exploitation can lead to high confidentiality impact and limited availability impact. The issue is resolved in version 2.5.3.

Affected products

wpjobportal WP Job Portal <= 2.5.2

Timeline

2026-05-11: disclosed: Reported by hhhai
2026-06-26: advisory: Published by Patchstack and NVD
2026-06-26: patched: Patch released in version 2.5.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.