Information Disclosure in WP Job Portal WordPress Plugin

Executive Summary

The WP Job Portal plugin before version 2.5.5 has an Insecure Direct Object Reference (IDOR) vulnerability. This flaw allows authenticated users with a subscriber-level account to access private email addresses of other employers. The vulnerability exists because the plugin does not verify whether the user owns the job listing when returning the employer's contact email. Attackers can exploit this by enumerating job identifiers to collect private emails from other employers.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized disclosure of private employer email addresses to any authenticated subscriber-level user. This exposure of sensitive contact information can result in privacy breaches, targeted phishing attacks, spam, or other malicious activities against the affected employers.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to enumerate job identifiers while authenticated with a subscriber-level account and checking if the employer's private email addresses are disclosed without proper ownership verification.

Specifically, an authenticated user can try to access the employer contact email endpoint for different job IDs to see if emails from other employers are returned.

No specific commands are provided in the available resources, but testing can be done by scripting HTTP requests to the plugin's API or web endpoints that return employer contact emails, iterating over job IDs.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate step to mitigate this vulnerability is to update the WP Job Portal plugin to version 2.5.5 or later, where the issue has been fixed.

Until the update can be applied, restrict subscriber-level user access or disable the plugin to prevent exploitation by unauthorized users.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows authenticated users with subscriber-level access to read other employers' private email addresses by exploiting a lack of ownership verification. This unauthorized disclosure of personal contact information could lead to non-compliance with data protection regulations such as GDPR, which mandates the protection of personal data and restricts unauthorized access and disclosure.

While the CVE description and resources do not explicitly mention compliance with standards like GDPR or HIPAA, the exposure of private email addresses due to broken access control represents a privacy risk that could violate such regulations.

Useful 0 Not Useful 0