CVE-2026-12397: WP Job Portal Information Disclosure Flaw

CVE-2026-12397 Overview

CVE-2026-12397 affects the WP Job Portal WordPress plugin in versions before 2.5.5. The plugin fails to verify ownership when returning an employer's contact email address for a given job listing. Authenticated users holding a subscriber-level account can enumerate job identifiers to harvest private employer email addresses. Because WordPress subscriber accounts are typically self-registerable, the barrier to exploitation is minimal.

The vulnerability is classified as an Insecure Direct Object Reference (IDOR) and results in disclosure of email addresses belonging to employer accounts on affected sites.

Critical Impact
Authenticated subscribers can enumerate job IDs to extract private employer email addresses, exposing operators of affected sites to targeted phishing and spam campaigns.

Affected Products

WP Job Portal WordPress plugin versions prior to 2.5.5
WordPress sites that permit self-registration of subscriber accounts
WordPress deployments exposing WP Job Portal job listing endpoints

Discovery Timeline

2026-07-13 - CVE-2026-12397 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-12397

Vulnerability Analysis

WP Job Portal exposes an endpoint that returns the contact email address of the employer associated with a given job listing. The endpoint accepts a job identifier as input and returns employer contact information as part of its response.

The plugin authenticates the request but does not check whether the caller is the owner of the requested job or otherwise entitled to view the employer's account email. A subscriber-level account, which any visitor can create on sites that allow open registration, satisfies the authentication requirement.

An attacker can iterate through numeric job identifiers and collect the associated employer email addresses at scale. The harvested addresses are private account emails rather than public contact addresses displayed on job listings, which increases their value for phishing operations.

Root Cause

The root cause is a missing authorization check on the endpoint that returns employer contact email data. The plugin relies solely on session authentication and does not enforce object-level access control that ties the requesting user to the requested job or employer record. This pattern maps to Broken Access Control and Insecure Direct Object Reference weakness classes.

Attack Vector

Exploitation is remote and requires a valid subscriber-level session. The attacker registers or reuses a low-privilege account, then issues repeated requests to the vulnerable endpoint while incrementing the job identifier. Each successful response yields one employer's private email address. No user interaction from the target employer is required. Refer to the WPScan Vulnerability Advisory for endpoint specifics.

No verified proof-of-concept code is published for this issue. The vulnerability mechanism is described in prose based on the vendor advisory.

Detection Methods for CVE-2026-12397

Indicators of Compromise

Sequential or high-volume requests from a single authenticated subscriber account against WP Job Portal job detail or employer contact endpoints.
Requests that iterate the job identifier parameter across a wide numeric range within a short time window.
New subscriber accounts registered shortly before enumeration activity begins.

Detection Strategies

Review web server and WordPress access logs for repeated requests to WP Job Portal AJAX or REST endpoints that include a job identifier parameter.
Correlate authenticated session cookies with request volume to identify accounts issuing enumeration patterns inconsistent with normal user behavior.
Alert when a single subscriber account requests employer contact data for more than a small threshold of distinct job IDs per hour.

Monitoring Recommendations

Ingest WordPress and reverse proxy access logs into a centralized log platform and apply rate-based rules to plugin endpoints.
Monitor user registration activity on sites with open subscriber registration for spikes that precede API enumeration.
Track outbound email volumes and phishing reports to detect downstream misuse of harvested employer addresses.

How to Mitigate CVE-2026-12397

Immediate Actions Required

Update the WP Job Portal plugin to version 2.5.5 or later on all affected WordPress installations.
Audit existing subscriber accounts and disable any created recently that do not correspond to legitimate users.
Review access logs for prior enumeration activity and notify employers whose email addresses may have been disclosed.

Patch Information

The vendor addressed the missing ownership check in WP Job Portal version 2.5.5. Administrators should apply the update through the WordPress plugin manager or by deploying the updated plugin package. See the WPScan Vulnerability Advisory for advisory details.

Workarounds

Disable open subscriber registration on affected sites until the plugin is updated by setting Anyone can register to off in WordPress general settings.
Restrict access to WP Job Portal endpoints at the web server or WAF layer to authenticated employer roles only.
Apply request rate limits to plugin endpoints that accept a job identifier parameter to slow enumeration attempts.

bash

# Example WAF rate limit rule for enumeration of WP Job Portal endpoints
# Limit authenticated subscribers to 10 requests per minute against job detail endpoints
limit_req_zone $binary_remote_addr zone=wpjp:10m rate=10r/m;

location ~* /wp-admin/admin-ajax.php|/wp-json/wpjobportal/ {
    limit_req zone=wpjp burst=5 nodelay;
    proxy_pass http://wordpress_backend;
}