CVE-2026-12397

The WP Job Portal WordPress plugin, in versions prior to 2.5.5 , is vulnerable to an Insecure Direct Object Reference (IDOR) . The application fails to verify ownership when returning an employer's contact email for a specific job. This allows authenticated users with a subscriber-level (self-reg...

PT-2026-57639

The WP Job Portal WordPress plugin before 2.5.5 does not verify ownership when returning an employer's contact email for a given job, allowing authenticated users with a subscriber-level self-registerable account to read other employers' private account email addresses by enumerating job...