An authenticated SQL injection vulnerability in the WP Job Portal plugin enables low-privileged subscribers to compromise database confidentiality through malicious query execution.

The plugin fails to properly sanitize user-supplied input before using it in SQL queries (CWE-89). Authenticated subscribers can exploit this to bypass intended data access restrictions and perform unauthorized database operations.

Exploitation of this vulnerability allows unauthorized access to data stored within the WordPress database, such as user information, application details, or configuration settings. This could lead to a significant breach of privacy and potential reputational damage. The CVSS score of 8.5 underscores the critical nature of this vulnerability.

Immediate Action: Update the WP Job Portal plugin to version 2.5.7 or later to remediate the vulnerability.

Proactive Monitoring: Monitor database query logs for suspicious patterns or unexpected syntax that may indicate an ongoing attempt to exploit SQL injection vulnerabilities.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter malicious traffic and block requests containing SQL injection payloads before they reach the application.

Public Exploit Available: Unknown

The availability of a patch makes remediation straightforward. All administrators are advised to update the WP Job Portal plugin to version 2.5.7 immediately to mitigate the risk of unauthorized database access. Verify that the update is successful by checking the plugin version in the WordPress dashboard.