CVE-2024-43266 WordPress WP Job Portal plugin <= 2.1.8 - Insecure Direct Object References (IDOR) vulnerability
An attacker can bypass authorization checks to access or modify other users' data in the WP Job Portal plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-43266?
CVE-2024-43266 is a medium-severity missing authorization vulnerability in wpjobportal WP Job Portal, published on 18 Aug 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Authorization Bypass Through User-Controlled Key vulnerability in wpjobportal WP Job Portal wp-job-portal.This issue affects WP Job Portal: from n/a through <= 2.1.8.
Weakness: CWE-639
Which versions are affected by CVE-2024-43266?
It affects 1 product.
Products include Wpjobportal Wp Job Portal.
How do I fix CVE-2024-43266?
No fix has been published for CVE-2024-43266 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-43266 being exploited?
There is no known exploitation of CVE-2024-43266 in the wild and no public exploit code.
Other vulnerabilities in wpjobportal WP Job Portal
- CVE-2024-7950 Missing authorization in WP Job Portal – AI-Powered Recruitment System for Company or Job Board website
- CVE-2023-4490 WP Job Portal < 2.0.6 - Unauthenticated SQLi
- CVE-2025-48274 WordPress WP Job Portal plugin <= 2.3.2 - SQL Injection Vulnerability
- CVE-2025-47438 WordPress WP Job Portal plugin <= 2.3.1 - Local File Inclusion vulnerability
- CVE-2025-48273 WordPress WP Job Portal plugin <= 2.3.2 - Arbitrary File Download Vulnerability
Sources
Also known as GHSA-82g8-5xqh-rc4v.