Description

Subscriber Insecure Direct Object References (IDOR) in WP Job Portal <= 2.5.9 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-28T16:18:29.367Z",
  "pubdate": "2026-08-28T16:18:29.367Z",
  "executiveSummary": "The WP Job Portal plugin for WordPress, specifically versions 2.5.9 and below, is affected by an Insecure Direct Object Reference (IDOR) vulnerability. This security flaw allows authenticated users with 'Subscriber' privileges to access or manipulate data belonging to other users or system objects that should be restricted based on authorization logic.\nThe vulnerability stems from improper access control checks within the application's request handling mechanisms. By manipulating object identifiers (such as ID parameters) in HTTP requests, an attacker can bypass authorization boundaries. The primary impact includes unauthorized data access, potential data modification, or exposure of sensitive information stored within the job portal ecosystem.\nThis vulnerability is critical because it leverages legitimate user accounts to perform unauthorized actions, effectively escalating the attacker's reach within the application context. Exploitation does not require elevated administrative privileges, making it a significant risk for any installation that allows user registration. Attackers can automate the enumeration and harvesting of sensitive portal data by iterating through sequential or predictable object identifiers, potentially compromising the confidentiality and integrity of the recruitment platform.",
  "technicalDetails": "The root cause of this IDOR vulnerability is the failure of the WP Job Portal plugin to perform server-side authorization validation before processing requests involving specific object identifiers. In many web applications, IDOR vulnerabilities arise when an application uses user-supplied input to directly access internal database records without verifying if the authenticated user has legitimate permission to access the requested resource.\nSpecifically, in versions 2.5.9 and earlier, the plugin components responsible for managing job listings, applications, or profile data fail to enforce an ownership or capability check on the backend. When a Subscriber-level user interacts with portal functionalities, the application typically transmits an HTTP GET or POST request containing parameters—often numerical IDs—associated with the target object. Because the application logic trusts these identifiers without validating the relationship between the session user and the resource being accessed, an attacker can modify these IDs to point to unauthorized resources.\nThe attack flow proceeds as follows: 1) The attacker authenticates as a standard Subscriber. 2) The attacker intercepts a legitimate request to the portal using a proxy tool (e.g., Burp Suite). 3) The attacker identifies a parameter representing an object ID (e.g., 'job_id', 'application_id', or 'user_id'). 4) The attacker modifies this ID to target a different record. 5) The server processes the request, fails to check if the current user owns or is authorized to view that record, and subsequently returns the requested sensitive data or performs the requested action on the object.\nThe affected component typically resides within the plugin’s AJAX handlers or custom endpoint controllers that lack proper 'current_user_can()' authorization checks or nonce validation for sensitive actions. Because the vulnerability exists at the logic layer, it is independent of specific network conditions and is reachable by any authenticated subscriber. Post-exploitation, an attacker can systematically scrape sensitive information, such as candidate resumes, recruiter contact details, or private job listing metadata, leading to a total breach of data privacy within the job board ecosystem."
}