WP Job Portal Insecure Direct Object Reference Vulnerability

A vulnerability allowing Insecure Direct Object Reference (IDOR) has been identified in the WP Job Portal plugin for WordPress, in all versions through 2.2.5. This vulnerability arises from inadequate validation of a user-controlled key, enabling authenticated attackers with Subscriber-level access or higher to submit resumes on behalf of other applicants when applying for jobs.

Impact

Exploitation of this vulnerability allows for unauthorized submission of resumes, potentially leading to misuse of the job application process.

Reproduction

To reproduce this vulnerability, an authenticated user with Subscriber-level access can apply for a job and inadvertently submit a resume for another applicant. This is made possible by the lack of proper validation on the key that controls resume submissions.

Remediation

Users are advised to update the WP Job Portal plugin to version 2.2.6 or later, where this vulnerability has been patched.