WP Job Portal Insecure Direct Object Reference Vulnerability Allowing Photo Deletion

A vulnerability exists in the WP Job Portal WordPress plugin, specifically in versions through 2.2.8. The issue is an Insecure Direct Object Reference (IDOR) that arises in the deleteUserPhoto() function, where user-controlled keys are not properly validated. This flaw enables authenticated attackers with Subscriber-level access or higher to remove profile photos from other users' accounts, although the actual file is not deleted.

Impact

Exploitation of this vulnerability allows for unauthorized removal of user profile photos, potentially leading to misuse of the photo deletion feature or causing confusion among users regarding their profile representation.

Remediation

Users are advised to update the WP Job Portal plugin to version 2.2.9 or a later patched version.