The WP Job Portal plugin for WordPress is susceptible to unauthenticated SQL injection, posing a significant risk of unauthorized database information disclosure.

This vulnerability is an SQL injection (CWE-89) stemming from insufficient input sanitization and parameterization of the radius parameter. It allows an unauthenticated attacker to manipulate database queries to exfiltrate sensitive data.

The ability for an unauthenticated user to interact directly with the database poses a high risk to data confidentiality. With a CVSS score of 7.5, this high-severity flaw could lead to the exposure of proprietary recruitment data, user credentials, or other sensitive information, resulting in significant regulatory and reputational damage.

Immediate Action: Update the WP Job Portal plugin to version 2.4.9 or later immediately to apply the vendor-supplied security patch.

Proactive Monitoring: Review database access logs for anomalous query patterns or unexpected strings originating from the radius parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common SQL injection patterns until the plugin can be successfully updated.

Public Exploit Available: Unknown

This vulnerability represents a critical risk to the confidentiality of information stored within the WP Job Portal plugin. IT administrators should prioritize upgrading to version 2.4.9 without delay, as the lack of authentication requirements makes this an attractive target for automated scanning and exploitation.