Executive brief
WP Job Portal is a WordPress plugin that enables job posting and management functionality on WordPress sites. The plugin contains an Insecure Direct Object References (IDOR) vulnerability that allows subscribers to access other users' data by manipulating object identifiers in URLs, potentially exposing sensitive job posting information and user details.
Technical details
The vulnerability is an Insecure Direct Object References (IDOR) flaw classified under OWASP Top 10 A1 (Broken Access Control). The plugin fails to properly validate access controls when subscribers request resources by ID, allowing an attacker to enumerate and retrieve data belonging to other users by modifying URL parameters. Exploitation requires a valid subscriber account and network access to the WordPress site. An attacker can view or potentially manipulate job postings, applications, and other objects not intended for their access. The vulnerability has been patched in version 2.6.0.
Affected products
- WP Job Portal WP Job Portal <= 2.5.9
Timeline
- 2026-08-15: disclosed: Reported to Patchstack
- 2026-08-27: advisory: Published by Patchstack
- 2026-08-27: patched: Fix released in version 2.6.0