WP Job Portal Missing Authorization Vulnerability Allowing Unauthenticated Arbitrary Email Sending

A vulnerability exists in the WP Job Portal WordPress plugin, specifically in versions through 2.2.6. The issue arises from a lack of proper capability checks in the sendEmailToJobSeeker() function, allowing unauthenticated users to send arbitrary emails with any content from the site's mail server.

Impact

Exploitation of this vulnerability allows for unauthorized users to send arbitrary emails from the site's mail server, potentially leading to phishing or spam-related issues.

Reproduction

To reproduce this vulnerability, send a request to the sendEmailToJobSeeker() function without the required authorization. Include the jobseeker's email, email subject, sender email, and email body in the request. The absence of a capability check will allow the email to be sent successfully, exploiting the vulnerability.

Remediation

Users are advised to update the WP Job Portal plugin to version 2.2.7 or later.