{"id":"CVE-2026-22386","kind":"vulnerability","aliases":["CVE-2026-22386"],"related":[],"title":"WP Job Portal WordPress plugin: missing authorization check through version 2.7.1","description":"Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through 2.7.1.","summary":"WP Job Portal, a WordPress job board plugin, has a missing authorization check that lets a user reach functions their role should not allow. The sources give a CVSS score of 4.3 (medium) and do not describe the exact data an attacker could read or change.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","wordpress","wp-job-portal"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/wp-job-portal/`.\n- Treat a version at or below `2.7.1` as affected, per the sources.","fix":null,"status":"open","published_at":"2026-10-29T13:17:10+00:00","first_seen_at":"2026-10-29T13:25:07+00:00","triaged_at":"2026-10-29T13:25:52+00:00","updated_at":"2026-10-29T13:25:52+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-29T13:25:52Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WP Job Portal WordPress plugin: missing authorization check through version 2.7.1","impact":"medium","summary":"WP Job Portal, a WordPress job board plugin, has a missing authorization check that lets a user reach functions their role should not allow. The sources give a CVSS score of 4.3 (medium) and do not describe the exact data an attacker could read or change.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-job-portal"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown access to plugin functions beyond the intended role","analyst_note":"Confirm the exact unauthorized action and required role from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-22386 and check the vendor for a fixed version.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/wp-job-portal/`.\n- Treat a version at or below `2.7.1` as affected, per the sources.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the WP Job Portal WordPress plugin at version 2.7.1 or earlier are in scope, according to the sources. The sources do not describe the specific configuration or role needed to reach the missing check. Sites that do not run this plugin can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000694,"input_tokens":4120,"output_tokens":563,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-22386':14A,17A '2.7.1':11A,98C '4.3':55B 'access':86C 'affect':91C 'ahmad':74C 'allow':47B,82C 'attack':65B 'author':7A,35B,71C 'board':30B 'chang':69B 'check':8A,36B 'configur':85C 'control':87C 'could':66B 'cve':12A,15A 'cvss':52B 'data':63B 'describ':60B 'exact':62B 'exploit':83C 'function':42B 'give':50B 'incorrect':84C 'issu':90C 'job':2A,22B,25B,29B,76C,80C,93C 'let':38B 'levels.this':89C 'medium':56B 'miss':6A,34B,70C 'n/a':96C 'packag':18B 'plugin':5A,31B 'portal':3A,23B,26B,77C,81C,94C 'reach':41B 'read':67B 'role':44B 'score':53B 'secur':88C 'sourc':49B 'user':40B 'version':10A 'vulner':72C 'wordpress':4A,19B,28B 'wp':1A,21B,24B,75C,79C,92C 'wp-job-port':20B,78C","nicknames":[],"mitigations":[],"who_affected":"Sites running the WP Job Portal WordPress plugin at version 2.7.1 or earlier are in scope, according to the sources. The sources do not describe the specific configuration or role needed to reach the missing check. Sites that do not run this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T13:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-22386","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22386","severity":null,"published_at":"2026-10-29T13:17:10+00:00","modified_at":"2026-10-29T13:17:10+00:00","first_seen_at":"2026-10-29T13:25:07+00:00","fetched_at":"2026-10-29T13:25:07+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}