4.3
Medium
CVE-2026-12397 The WP Job Portal WordPress plugin before 2.5.5 does not verify ownership when returning an employer's contact email…
Description
The WP Job Portal WordPress plugin before 2.5.5 does not verify ownership when returning an employer's contact email for a given job, allowing authenticated users with a subscriber-level (self-registerable) account to read other employers' private account email addresses by enumerating job identifiers.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| WP Job Portal 2.5 | earliest → < 2.5.5 | 2.5.5 |
Other CVEs of WP Job Portal
The 4 CVEs of WP Job Portal →
CVE-2026-12395
The WP Job Portal WordPress plugin before 2.5.5 does not properly sanitize and escape a parameter before using it in…
6.5
Medium
CVE-2026-12396
The WP Job Portal WordPress plugin before 2.5.5 does not perform capability or ownership checks before allowing job…
5.4
Medium
CVE-2023-4490
The WP Job Portal WordPress plugin before 2.0.6 does not sanitise and escape a parameter before using it in a SQL…
9.8
Critical