CVE-2026-81299 MEDIUM

CVE-2026-81299: WordPress WP Job Portal plugin <= 2.5.9 - Insecure Direct Object References (IDOR) vulnerability

Vendor Ahmad
Product WP Job Portal
Weakness CWE-639 · IDOR
Published August 28, 2026
Last update August 28, 2026
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Subscriber Insecure Direct Object References (IDOR) in WP Job Portal <= 2.5.9 versions.

Explanation of Vulnerability in Simple Terms

02Summary

WP Job Portal versions up to 2.5.9 contain an authorization bypass vulnerability in user-controlled key handling. A logged-in attacker can modify requests to alter data they should not have access to. The vulnerability requires low privileges and no user interaction. Update to a version newer than 2.5.9 to remediate.

What an attacker can do

03Attacker Capabilities

Modify job listings or portal data belonging to other users without proper authorization.

Potential impact on your site

04Site Impact

Unauthorized changes to job postings and portal content; data integrity compromised across the job board.

Conditions required to exploit

05Prerequisites

Attacker must have a valid user account with low-level access to the plugin.

Key dates

06Disclosure timeline

August 28, 2026 CVE published
August 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-15159 Ninja Forms - Excel Export <= 3.3.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Data Disclosure via 'spreadsheet_export_form_id' Parameter CVE-2026-3688 WCFM - WooCommerce Multivendor Membership <= 2.11.10 - Insecure Direct Object Reference to Limited Privilege Escalation via User Role Overwrite CVE-2026-77998 Joomla Extension - miniorange.com - Unauthenticated Authentication Bypass via SAMLResponse Parameter in miniOrange SAML SSO < 11.0.2, SAML SP Single Sign On – Login with ADFS < 6.4, SAML SP Single Sign On – SAML SSO login with Google Apps < 6.4 CVE-2026-77990 Joomla Extension - joomlaeventmanager.net - Attendee lists readable by any logged-in user in Joomla Event Manager < 5.0.1 CVE-2026-61946 WordPress Easy Appointments plugin <= 3.12.27 - Insecure Direct Object References (IDOR) vulnerability