# CVE-2026-81299: WP Job Portal Insecure Direct Object References

Source: https://junglewise.ai/threats/cve-2026-81299-wp-job-portal-insecure-direct-object-references  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-81299 · Severity: medium · CVSS 4.3 · Published 2026-08-28

WP Job Portal is a WordPress plugin that enables job posting and management functionality on WordPress sites. The plugin contains an Insecure Direct Object References (IDOR) vulnerability that allows subscribers to access other users' data by manipulating object identifiers in URLs, potentially exposing sensitive job posting information and user details.

## Quick answers

**Is CVE-2026-81299 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-81299 being exploited in the wild.

**How severe is CVE-2026-81299?** Medium severity, with a CVSS score of 4.3, published 28 August 2026.

**Which products and versions are affected?** WP Job Portal WP Job Portal <= 2.5.9.

**Is there a fix for CVE-2026-81299?** A patch was published on 2026-08-27: Fix released in version 2.6.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-81299 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-81299?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an Insecure Direct Object References (IDOR) flaw classified under OWASP Top 10 A1 (Broken Access Control). The plugin fails to properly validate access controls when subscribers request resources by ID, allowing an attacker to enumerate and retrieve data belonging to other users by modifying URL parameters. Exploitation requires a valid subscriber account and network access to the WordPress site. An attacker can view or potentially manipulate job postings, applications, and other objects not intended for their access. The vulnerability has been patched in version 2.6.0.

## Affected products

- WP Job Portal WP Job Portal <= 2.5.9

## Timeline

- 2026-08-15: disclosed: Reported to Patchstack
- 2026-08-27: advisory: Published by Patchstack
- 2026-08-27: patched: Fix released in version 2.6.0

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/wp-job-portal/vulnerability/wordpress-wp-job-portal-plugin-2-5-9-insecure-direct-object-references-idor-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/wp-job-portal/vulnerability/wordpress-wp-job-portal-plugin-2-5-9-insecure-direct-object-references-idor-vulnerability?_s_id=cve)