This vulnerability is an Insecure Direct Object Reference in the WP Job Portal plugin that allows an attacker to bypass authorization checks using a user‑controlled key. It is an Authorization Bypass Through User‑Controlled Key vulnerability that exploits incorrectly configured access‑control security levels and corresponds to CWE‑639. The flaw permits the exploitation of incorrect access‑control configurations, enabling the discovery, read, or modification of job postings and related data without proper permissions. The impact is a loss of data confidentiality and integrity for all users, potentially affecting the entire site if administrative data can be accessed.

The WP Job Portal plugin for WordPress, version 2.4.3 or earlier, is affected. No specific sub‑versions are listed beyond the maximum of 2.4.3, so any installation of the plugin using that or older releases is vulnerable.

The CVSS score of 9.1 indicates a high‑severity risk. The EPSS score is less than 1% at the time of analysis, suggesting that active exploitation is currently rare, and the vulnerability is not listed in the KEV catalog. Based on the description, it is inferred that the attacker could trigger the vulnerability remotely via crafted HTTP requests to the plugin’s endpoints, without needing elevated privileges. This could allow data disclosure or modification, posing a significant threat even if exploitation attempts are infrequent.