WP Job Portal Insecure Direct Object Reference Vulnerability Allowing Unauthenticated Logo Deletion

A vulnerability exists in the WP Job Portal WordPress plugin, specifically in versions through 2.2.6. The issue is an Insecure Direct Object Reference (IDOR) that allows unauthenticated users to delete arbitrary company logos. This vulnerability arises from the deleteCompanyLogo() function, which lacks proper validation on user-controlled keys.

Impact

Exploitation of this vulnerability allows for unauthorized deletion of company logos, potentially disrupting the visual branding or representation of businesses using the job portal plugin.

Remediation

Users are advised to update the WP Job Portal plugin to version 2.2.7 or a newer patched version.