CVE-2026-42684: WordPress WP Job Portal plugin <= 2.5.1 - SQL Injection vulnerability

Synopsis

An unauthenticated SQL injection vulnerability affects the WP Job Portal WordPress plugin at version 2.5.1 and earlier. The flaw is reachable over the network with no credentials required, and successful exploitation uses a blind injection technique to extract data from the underlying database across scope boundaries. An attacker can read sensitive application data from the database and cause limited disruption to availability. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, meaning an attacker must be able to reach the WordPress installation via HTTP/HTTPS from any external or internal network position.

• AuthenticationNot required

  No account or session credentials of any kind are needed; the injection point is accessible to anonymous requests.

• Victim interactionNot required

  The attack is fully server-side and requires no action from any user or administrator of the affected site.

• Attack complexityDetail

  Exploitation is reliable and condition-free once the service is reachable, though blind injection techniques require iterative querying to extract data rather than a single direct response.

Blast Radius

• An attacker can extract the full contents of the WordPress database, including user credentials (hashed passwords), email addresses, private job listings, and applicant records.
• Because the CVSS scope is Changed (S:C), the impact can extend beyond the plugin itself to other data stored in the shared database instance, such as tables belonging to other plugins or the WordPress core.
• Availability impact is rated Low: the injection queries can degrade database responsiveness or cause intermittent errors for legitimate users, though a full service crash is not the primary risk.