CVE-2023-4490: WP Job Portal < 2.0.6 - Unauthenticated SQLi

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-09-25 · updated 2026-06-17

Description

The WP Job Portal WordPress plugin before 2.0.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users

Affected products

wpjobportal WP Job Portal – AI-Powered Recruitment System for Company or Job Board website: before 2.0.6 — fixed in 2.0.6

How to fix

Upgrade to a fixed version: wpjobportal WP Job Portal – AI-Powered Recruitment System for Company or Job Board website 2.0.6. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/986024f0-3c8d-44d8-a9c9-1dd284d7db0d
https://wpscan.com/vulnerability/986024f0-3c8d-44d8-a9c9-1dd284d7db0d

Get alerted when CVE-2023-4490 or the next vulnerability affects your stack