# WP Job Portal – AI-Powered Recruitment System for Company or Job Board website <= 2.8.0 - Authenticated (Subscriber+) Insecure Direct Object Reference to Unpublished Resume Disclosure

- **ID:** WPSEC-2026-3018
- **Plugin:** WP Job Portal – AI-Powered Recruitment System for Company or Job Board website (`wp-job-portal`), https://wordpress.org/plugins/wp-job-portal/
- **Affected versions:** all versions before 2.8.1
- **Fixed in:** 2.8.1 (Update to 2.8.1 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-job-portal
- **Fix released:** 2026-11-12
- **Published:** 2026-11-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3018/

## Description

The WP Job Portal plugin for WordPress is vulnerable to Insecure Direct Object Reference via the resume view page in all versions up to, and including, 2.8.0, due to missing authorization checks when an employer views a resume by its id: the resume owner is read from the requested resume for every employer, and the resume's approval status and searchable flag are never checked. This makes it possible for authenticated attackers, with an employer account (subscriber-level) and above, to view any resume by id, including unapproved and non-searchable ones, along with their sections and, depending on the contact-detail setting, the owner's contact details.

## References

- https://wpsec.com/vuln/WPSEC-2026-3018/
- https://plugins.svn.wordpress.org/wp-job-portal/tags/2.8.1/
- https://wordpress.org/plugins/wp-job-portal/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3018/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.