WP Job Portal is a WordPress plugin that enables employers to post jobs. In versions older than 2.5.5, the plugin fails to verify that the requester owns or is authorized to view a job’s employer contact email. An authenticated user with a subscriber‑level account can supply a job identifier and receive the employer’s private email address. This flaw is an IDOR that results in a disclosure of confidential contact information. The official vulnerability description does not specify any further malicious use beyond revealing the email addresses.

Any WordPress website that installs the WP Job Portal plugin with a version earlier than 2.5.5. The flaw is limited to the email lookup functionality of the plugin; no other WordPress core components or unrelated plugins are implicated. Sites that allow subscriber registration and provide access to job posting identifiers are especially vulnerable.

Exploit requires the attacker to be an authenticated subscriber, which is a normal access level for registrants. Once logged in, the attacker can enumerate job identifiers to retrieve multiple employer emails. The CVSS score moderate severity, while an EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, which further reduces the sense of urgency. Therefore, the overall risk is moderate, primarily due to the potential exposure of a large number of email addresses to unauthorised parties.