WP Job Portal – AI-Powered Recruitment System for Company or Job Board website <= 2.8.0 - Authenticated (Subscriber+) Insecure Direct Object Reference to Unpublished Resume Disclosure
- ID
- WPSEC-2026-3018
- Plugin
- WP Job Portal – AI-Powered Recruitment System for Company or Job Board website (wp-job-portal)
- Affected
- all versions before 2.8.1
- Remediation
- Update to 2.8.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-13
- Attack surface
- WP Job Portal – AI-Powered Recruitment System for Company or Job Board website on WPSec AttackSurface
- Fix released
- Published
Description
The WP Job Portal plugin for WordPress is vulnerable to Insecure Direct Object Reference via the resume view page in all versions up to, and including, 2.8.0, due to missing authorization checks when an employer views a resume by its id: the resume owner is read from the requested resume for every employer, and the resume's approval status and searchable flag are never checked. This makes it possible for authenticated attackers, with an employer account (subscriber-level) and above, to view any resume by id, including unapproved and non-searchable ones, along with their sections and, depending on the contact-detail setting, the owner's contact details.
References
- https://wpsec.com/vuln/WPSEC-2026-3018/
- https://plugins.svn.wordpress.org/wp-job-portal/tags/2.8.1/
- https://wordpress.org/plugins/wp-job-portal/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS