The WP Job Portal plugin contains an SQL Injection weakness that allows an attacker to insert crafted input that is not properly neutralized into SQL statements. This blind injection can reveal or modify data within the WordPress database, potentially exposing user credentials, job listings, and other sensitive information. The flaw is classified as CWE‑89 and the exposed data could lead to loss of confidentiality, integrity, or availability depending on what is accessed or altered.

WordPress installations running the WP Job Portal plugin by wpjobportal are affected when the plugin version is 2.3.2 or older. All releases from the earliest available to and including 2.3.2 contain the vulnerability. The plugin is packaged as a WordPress extension and its CPE identifier is cpe:2.3:a:wpjobportal:wp_job_portal:*:*:*:*:*:wordpress:*:*.

The CVSS score of 9.3 places this issue in the critical severity range. The EPSS score indicates that current exploitation probability is low (<1%), and the vulnerability is not in the CISA KEV catalog. Because the flaw is a blind SQL injection, an attacker would need to send specially crafted requests to the plugin’s HTTP endpoints and analyze time‑based or error responses to infer data. Although no active exploitation is reported, the high potential impact and the lack of access restrictions make it prudent to apply a fix or mitigate the vulnerability as soon as possible.