5.4
Medium
CVE-2026-12396 The WP Job Portal WordPress plugin before 2.5.5 does not perform capability or ownership checks before allowing job…
Description
The WP Job Portal WordPress plugin before 2.5.5 does not perform capability or ownership checks before allowing job moderation actions, allowing authenticated users with a subscriber-level (self-registerable) account to approve, feature, or reject arbitrary jobs, including those owned by other users.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| WP Job Portal 2.5 | earliest → < 2.5.5 | 2.5.5 |
Other CVEs of WP Job Portal
The 4 CVEs of WP Job Portal →
CVE-2026-12395
The WP Job Portal WordPress plugin before 2.5.5 does not properly sanitize and escape a parameter before using it in…
6.5
Medium
CVE-2026-12397
The WP Job Portal WordPress plugin before 2.5.5 does not verify ownership when returning an employer's contact email…
4.3
Medium
CVE-2023-4490
The WP Job Portal WordPress plugin before 2.0.6 does not sanitise and escape a parameter before using it in a SQL…
9.8
Critical