The WP Job Portal WordPress plugin contains an unsanitized parameter in a SQL query that allows authenticated users with inject malicious SQL. Based on the description, it is inferred that this injection could read or modify the database contents, potentially exposing or altering job listings, resumes, or user information. The flaw is a classic SQL injection (CWE‑89).

The issue exists in the WP Job Portal plugin versions prior to 2.5.5. Users running the plugin earlier than 2.5.5 on any WordPress installation are potentially affected. The plugin is published by an unnamed vendor labeled "WP Job Portal".

The CVSS score of 6.5 signifies a moderate severity. The EPSS score of less than 1% indicates a very low probability of exploitation at the time of assessment. The vulnerability is not listed in CISA's KEV catalog. An authenticated subscriber‑level user must access the applied resumes feature that supplies the ta parameter to the backend in order to exploit the issue. It is inferred that if an attacker can supply arbitrary SQL through this parameter, they could read or manipulate database content, enabling data exfiltration or other malicious actions.