{"id":"CVE-2026-124753","kind":"vulnerability","aliases":["CVE-2026-124753"],"related":[],"title":"WP Job Portal WordPress plugin: missing authorization check on access control","description":"Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through 2.7.2.","summary":"The WP Job Portal WordPress plugin has a missing authorization check, which the advisory describes as incorrectly configured access control levels. The sources do not say what data or actions an attacker can reach through it.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","wordpress","wp-job-portal"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed WP Job Portal plugin version in the WordPress admin under Plugins; the advisory covers versions through `2.7.2`.","fix":"- WP Job Portal: unknown (sources say only that the issue affects versions through `2.7.2`)","status":"open","published_at":"2026-11-11T12:19:48+00:00","first_seen_at":"2026-11-11T12:27:11+00:00","triaged_at":"2026-11-11T12:29:01+00:00","updated_at":"2026-11-11T12:29:01+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-11T12:29:01Z","model":"claude-haiku-5-5","output":{"fix":"- WP Job Portal: unknown (sources say only that the issue affects versions through `2.7.2`)","reach":"unknown","title":"WP Job Portal WordPress plugin: missing authorization check on access control","impact":"medium","summary":"The WP Job Portal WordPress plugin has a missing authorization check, which the advisory describes as incorrectly configured access control levels. The sources do not say what data or actions an attacker can reach through it.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-job-portal"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown access control bypass on the job portal site","analyst_note":"Find the NVD or Wordfence entry to confirm which actions lack the authorization check, whether authentication is required, and the first fixed version.","how_to_check":"- Check the installed WP Job Portal plugin version in the WordPress admin under Plugins; the advisory covers versions through `2.7.2`.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the WP Job Portal WordPress plugin at version `2.7.2` or earlier are in scope. The sources do not say which access control paths are missing checks or whether anonymous users can reach them.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000711,"input_tokens":4548,"output_tokens":513,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124753':14A,17A '-2026':13A,16A '2.7.2':86C 'access':10A,42B,74C 'action':53B 'advisori':37B 'affect':79C 'ahmad':62C 'allow':70C 'attack':55B 'author':7A,33B,59C 'check':8A,34B 'configur':41B,73C 'control':11A,43B,75C 'cve':12A,15A 'data':51B 'describ':38B 'exploit':71C 'incorrect':40B,72C 'issu':78C 'job':2A,22B,26B,64C,68C,81C 'level':44B 'levels.this':77C 'miss':6A,32B,58C 'n/a':84C 'packag':18B 'plugin':5A,29B 'portal':3A,23B,27B,65C,69C,82C 'reach':57B 'say':49B 'secur':76C 'sourc':46B 'vulner':60C 'wordpress':4A,19B,28B 'wp':1A,21B,25B,63C,67C,80C 'wp-job-port':20B,66C","nicknames":[],"mitigations":[],"who_affected":"Sites running the WP Job Portal WordPress plugin at version `2.7.2` or earlier are in scope. The sources do not say which access control paths are missing checks or whether anonymous users can reach them.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","wordpress","wpjobportal"],"campaign_type":null,"search_a":"'-124753':14A,17A '-2026':13A,16A 'access':10A 'author':7A 'check':8A 'control':11A 'cve':12A,15A 'job':2A 'miss':6A 'plugin':5A 'portal':3A 'wordpress':4A 'wp':1A","search_b":"'access':42B 'action':53B 'advisori':37B 'attack':55B 'author':33B 'check':34B 'configur':41B 'control':43B 'data':51B 'describ':38B 'incorrect':40B 'job':22B,26B 'level':44B 'miss':32B 'packag':18B 'plugin':29B 'portal':23B,27B 'reach':57B 'say':49B 'sourc':46B 'wordpress':19B,28B 'wp':21B,25B 'wp-job-port':20B","search_c":"'2.7.2':86C 'access':74C 'affect':79C 'ahmad':62C 'allow':70C 'author':59C 'configur':73C 'control':75C 'exploit':71C 'incorrect':72C 'issu':78C 'job':64C,68C,81C 'levels.this':77C 'miss':58C 'n/a':84C 'portal':65C,69C,82C 'secur':76C 'vulner':60C 'wp':63C,67C,80C 'wp-job-port':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T12:19:48+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124753","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124753","severity":null,"published_at":"2026-11-11T12:19:48+00:00","modified_at":"2026-11-11T12:19:48+00:00","first_seen_at":"2026-11-11T12:27:11+00:00","fetched_at":"2026-11-11T12:27:11+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}