{"id":"CVE-2026-124416","kind":"vulnerability","aliases":["CVE-2026-124416"],"related":[],"title":"WP Job Portal WordPress plugin: missing authorization check exposes access control","description":"Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through 2.7.2.","summary":"The WP Job Portal WordPress plugin, versions through 2.7.2, has a missing authorization check that allows access control to be bypassed. The sources do not say what data or actions an attacker can reach through it.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"wp-job-portal","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["package","wordpress","wp-job-portal"],"not_affected_if":[],"how_to_check":"- Check the installed version of the WP Job Portal plugin in the WordPress admin under Plugins; versions through `2.7.2` are listed as affected.","fix":null,"status":"open","published_at":"2026-11-11T13:17:19+00:00","first_seen_at":"2026-11-11T13:27:12+00:00","triaged_at":"2026-11-11T13:29:50+00:00","updated_at":"2026-11-11T13:29:50+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-11T13:29:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WP Job Portal WordPress plugin: missing authorization check exposes access control","impact":"medium","summary":"The WP Job Portal WordPress plugin, versions through 2.7.2, has a missing authorization check that allows access control to be bypassed. The sources do not say what data or actions an attacker can reach through it.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-job-portal"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown access control bypass; extent of data exposure unstated","analyst_note":"Confirm the affected plugin versions, the exact missing check, and the fixed version from the NVD entry or the plugin vendor's advisory.","how_to_check":"- Check the installed version of the WP Job Portal plugin in the WordPress admin under Plugins; versions through `2.7.2` are listed as affected.\n- unknown","plain_action":"","product_name":"wp-job-portal","needs_analyst":true,"not_affected_if":[],"who_is_affected":"WordPress sites running the WP Job Portal plugin at version 2.7.2 or earlier are listed as affected. The sources do not say which configurations or roles are required to reach the flaw.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000707,"input_tokens":4548,"output_tokens":505,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124416':14A,17A '-2026':13A,16A '2.7.2':36B,90C 'access':10A,44B,78C 'action':57B 'affect':83C 'ahmad':66C 'allow':43B,74C 'attack':59B 'author':7A,40B,63C 'bypass':48B 'check':8A,41B 'configur':77C 'control':11A,45B,79C 'cve':12A,15A 'data':55B 'exploit':75C 'expos':9A 'incorrect':76C 'issu':82C 'job':2A,20A,26B,30B,68C,72C,85C 'levels.this':81C 'miss':6A,39B,62C 'n/a':88C 'packag':22B 'plugin':5A,33B 'portal':3A,21A,27B,31B,69C,73C,86C 'reach':61B 'say':53B 'secur':80C 'sourc':50B 'version':34B 'vulner':64C 'wordpress':4A,23B,32B 'wp':1A,19A,25B,29B,67C,71C,84C 'wp-job-port':24B,70C 'wp-job-portal':18A","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running the WP Job Portal plugin at version 2.7.2 or earlier are listed as affected. The sources do not say which configurations or roles are required to reach the flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["wpjobportal"],"ptokens":["job","portal","wp"],"labels":["medium","package","vendor","wordpress","wpjobportal"],"campaign_type":null,"search_a":"'-124416':14A,17A '-2026':13A,16A 'access':10A 'author':7A 'check':8A 'control':11A 'cve':12A,15A 'expos':9A 'job':2A,20A 'miss':6A 'plugin':5A 'portal':3A,21A 'wordpress':4A 'wp':1A,19A 'wp-job-portal':18A","search_b":"'2.7.2':36B 'access':44B 'action':57B 'allow':43B 'attack':59B 'author':40B 'bypass':48B 'check':41B 'control':45B 'data':55B 'job':26B,30B 'miss':39B 'packag':22B 'plugin':33B 'portal':27B,31B 'reach':61B 'say':53B 'sourc':50B 'version':34B 'wordpress':23B,32B 'wp':25B,29B 'wp-job-port':24B","search_c":"'2.7.2':90C 'access':78C 'affect':83C 'ahmad':66C 'allow':74C 'author':63C 'configur':77C 'control':79C 'exploit':75C 'incorrect':76C 'issu':82C 'job':68C,72C,85C 'levels.this':81C 'miss':62C 'n/a':88C 'portal':69C,73C,86C 'secur':80C 'vulner':64C 'wp':67C,71C,84C 'wp-job-port':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T13:17:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124416","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124416","severity":null,"published_at":"2026-11-11T13:17:19+00:00","modified_at":"2026-11-11T13:17:19+00:00","first_seen_at":"2026-11-11T13:27:12+00:00","fetched_at":"2026-11-11T13:27:12+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}