Description

Subscriber SQL Injection in WP Job Portal <= 2.5.6 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-08-06T15:17:18.307Z",
  "pubdate": "2026-08-06T15:17:18.307Z",
  "executiveSummary": "An SQL injection vulnerability exists in the WP Job Portal plugin affecting versions <= 2.5.6. This security flaw allows authenticated users with subscriber-level privileges to manipulate database queries through unsanitized input parameters.\nThe primary impact of this vulnerability includes unauthorized database access, potential extraction of sensitive information such as user credentials and system data, and potential data modification or deletion depending on the database user permissions.\nThe affected product is the WP Job Portal plugin for WordPress across all versions up to and including 2.5.6. The risk implications are severe, as successful exploitation compromises the confidentiality, integrity, and availability of the underlying database.\nAn attacker must possess authenticated access with at least subscriber-level privileges to interact with the vulnerable functionality. No complex exploitation requirements are specified beyond the capability to submit crafted HTTP requests containing malicious SQL payloads to the vulnerable endpoints within the plugin.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient input sanitization and lack of proper parameterization within database query constructions inside the WP Job Portal plugin for versions <= 2.5.6.\nThe vulnerable component processes user-supplied input parameters within database operations without enforcing strict type checking, escaping, or utilizing prepared statements via the WordPress database abstraction layer ($wpdb).\nAuthentication and privilege requirements dictate that the attacker must be authenticated as a subscriber-level user, meaning the attack is localized post-authentication rather than being accessible to unauthenticated anonymous visitors over the network.\nThe attack flow proceeds as follows: First, the authenticated attacker identifies a vulnerable endpoint or function within the WP Job Portal plugin that accepts parameters destined for SQL execution. Second, the attacker crafts a malicious HTTP request embedding SQL injection payloads—such as UNION-based or boolean-based constructs—into the vulnerable parameter.\nUpon receiving the request, the vulnerable component passes the unsanitized input directly into the database query execution routine. The database engine interprets the injected payload as part of the SQL command, altering the intended query logic.\nPayload behavior allows the execution of arbitrary SQL commands within the context of the database user configured for the WordPress application. This facilitates post-exploitation impact such as data exfiltration, enumeration of database schemas, dumping of user tables containing password hashes, and potentially escalating privileges within the application if further related flaws are chained."
}