Description
The WP Job Portal WordPress plugin before 2.5.5 does not verify ownership when returning an employer's contact email for a given job, allowing authenticated users with a subscriber-level (self-registerable) account to read other employers' private account email addresses by enumerating job identifiers.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | WP Job Portal | < 2.5.5 | 2.5.5 |
References
- https://wpscan.com/vulnerability/8e797251-2351-4979-a6c1-c05c78622327/ exploit vdb-entry technical-description