The WP Job Portal plugin for WordPress contains a parameter‑level SQL injection flaw in the 'radius' variable. Because the value is used directly in a database query without proper escaping or prepared statements, an attacker can inject arbitrary SQL commands. This allows unauthenticated users to retrieve sensitive data from the database, compromising confidentiality. The vulnerability is classified as CWE‑89 and scores a CVSS of 7.5, indicating a high severity. No evidence that it is currently listed in CISA’s KEV catalog, but the lack of authentication checks makes exploitation straightforward.

The flaw affects all installations of the WP Job Portal plugin with version numbers 2.4.8 or earlier. The plugin is a WordPress add‑on that powers recruitment sites. Any WordPress site that has the plugin version 2.4.8 or older is at risk, regardless of the WordPress core version.

The CVSS score of 7.5 signifies a serious threat, and while EPSS data is unavailable, the unauthenticated nature of the flaw means an attacker can construct a malicious HTTP request containing a crafted 'radius' parameter and cause the database server to execute unintended statements. If exploited, the attacker could read or dump the entire database. The vulnerability is not currently known to be exploited in the wild, but its high severity and ease of exploitation warrant urgent attention.