{"id":"CVE-2026-121014","kind":"vulnerability","aliases":["CVE-2026-121014"],"related":[],"title":"WP Job Portal WordPress plugin: missing authorization check exposes access controls","description":"Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through 2.7.2.","summary":"WP Job Portal, a WordPress job board plugin, has a missing authorization check that allows access control settings to be misused. The sources do not say what data or actions an attacker can reach in practice.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","wordpress","wp-job-portal"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed WP Job Portal plugin version in the WordPress admin under Plugins; versions through `2.7.2` are listed as affected.","fix":"- WP Job Portal: a fixed version is not stated in the sources; versions through `2.7.2` are affected.","status":"open","published_at":"2026-11-11T12:19:32+00:00","first_seen_at":"2026-11-11T12:27:10+00:00","triaged_at":"2026-11-11T12:28:59+00:00","updated_at":"2026-11-11T12:28:59+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-11-11T12:28:59Z","model":"claude-haiku-5-5","output":{"fix":"- WP Job Portal: a fixed version is not stated in the sources; versions through `2.7.2` are affected.","reach":"internet","title":"WP Job Portal WordPress plugin: missing authorization check exposes access controls","impact":"medium","summary":"WP Job Portal, a WordPress job board plugin, has a missing authorization check that allows access control settings to be misused. The sources do not say what data or actions an attacker can reach in practice.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-job-portal"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown access to job portal data or actions","analyst_note":"Confirm the affected role, the data or actions exposed, and whether a fixed version exists, using the NVD entry and the plugin's changelog.","how_to_check":"- Check the installed WP Job Portal plugin version in the WordPress admin under Plugins; versions through `2.7.2` are listed as affected.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the WP Job Portal WordPress plugin at version 2.7.2 or earlier are in the affected range. The sources do not describe the exact role or configuration needed to exploit it.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000709,"input_tokens":4548,"output_tokens":509,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121014':14A,17A '-2026':13A,16A '2.7.2':88C 'access':10A,39B,76C 'action':53B 'affect':81C 'ahmad':64C 'allow':38B,72C 'attack':55B 'author':7A,35B,61C 'board':30B 'check':8A,36B 'configur':75C 'control':11A,40B,77C 'cve':12A,15A 'data':51B 'exploit':73C 'expos':9A 'incorrect':74C 'issu':80C 'job':2A,22B,25B,29B,66C,70C,83C 'levels.this':79C 'miss':6A,34B,60C 'misus':44B 'n/a':86C 'packag':18B 'plugin':5A,31B 'portal':3A,23B,26B,67C,71C,84C 'practic':59B 'reach':57B 'say':49B 'secur':78C 'set':41B 'sourc':46B 'vulner':62C 'wordpress':4A,19B,28B 'wp':1A,21B,24B,65C,69C,82C 'wp-job-port':20B,68C","nicknames":[],"mitigations":[],"who_affected":"Sites running the WP Job Portal WordPress plugin at version 2.7.2 or earlier are in the affected range. The sources do not describe the exact role or configuration needed to exploit it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","wordpress","wpjobportal"],"campaign_type":null,"search_a":"'-121014':14A,17A '-2026':13A,16A 'access':10A 'author':7A 'check':8A 'control':11A 'cve':12A,15A 'expos':9A 'job':2A 'miss':6A 'plugin':5A 'portal':3A 'wordpress':4A 'wp':1A","search_b":"'access':39B 'action':53B 'allow':38B 'attack':55B 'author':35B 'board':30B 'check':36B 'control':40B 'data':51B 'job':22B,25B,29B 'miss':34B 'misus':44B 'packag':18B 'plugin':31B 'portal':23B,26B 'practic':59B 'reach':57B 'say':49B 'set':41B 'sourc':46B 'wordpress':19B,28B 'wp':21B,24B 'wp-job-port':20B","search_c":"'2.7.2':88C 'access':76C 'affect':81C 'ahmad':64C 'allow':72C 'author':61C 'configur':75C 'control':77C 'exploit':73C 'incorrect':74C 'issu':80C 'job':66C,70C,83C 'levels.this':79C 'miss':60C 'n/a':86C 'portal':67C,71C,84C 'secur':78C 'vulner':62C 'wp':65C,69C,82C 'wp-job-port':68C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T12:19:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121014","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121014","severity":null,"published_at":"2026-11-11T12:19:32+00:00","modified_at":"2026-11-11T12:19:33+00:00","first_seen_at":"2026-11-11T12:27:10+00:00","fetched_at":"2026-11-11T12:27:10+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}