PT-2026-27253 · WordPress · Wp Job Portal

Leonid Semenenko · Publicado 2026-03-23 · Atualizado 2026-03-24 · CVE-2026-4306

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WP Job Portal plugin for WordPress versions prior to 2.4.9

Description The WP Job Portal plugin for WordPress is susceptible to SQL Injection due to inadequate input sanitization and insufficient SQL query preparation. Specifically, the radius parameter is not properly escaped, allowing unauthenticated attackers to inject additional SQL queries into existing database queries. This could enable attackers to extract sensitive information from the database.

Recommendations Update the WP Job Portal plugin to version 2.4.9 or later.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2026-4306

Produtos afetados

Wp Job Portal

Referências · 6

• https://plugins.trac.wordpress.org/browser/wp-job-portal/tags/2.4.7/modules/job/model.php#L2743 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-4306 · Nota de Segurança
• https://plugins.trac.wordpress.org/changeset?old_path=/wp-job-portal/tags/2.4.8&new_path=/wp-job-portal/tags/2.4.9 · Nota
• https://plugins.trac.wordpress.org/browser/wp-job-portal/tags/2.4.7/includes/ajax.php#L10 · Nota
• https://twitter.com/VulmonFeeds/status/2036234615518535740 · Publicação no Twitter
• https://wordfence.com/threat-intel/vulnerabilities/id/ecc34552-c9b0-455f-b1c7-b31cc847cb22?source=cve · Nota