WP Job Portal Insecure Direct Object Reference Vulnerability Allowing Unauthenticated Resume Downloads

A vulnerability exists in the WP Job Portal WordPress plugin, specifically in versions through 2.2.6. The issue is an Insecure Direct Object Reference (IDOR) that allows unauthenticated users to download resumes from other users without proper authorization. This vulnerability arises from missing validation on a user-controlled key in the 'getresumefiledownloadbyid()' and 'getallresumefiles()' functions.

Impact

Exploitation of this vulnerability allows for unauthorized downloading of user resumes, potentially leading to privacy violations and unauthorized access to personal information.

Remediation

Users are advised to update the WP Job Portal plugin to version 2.2.7 or a newer patched version.