Critical severity · published Jun 2, 2026
CVE-2026-42684
WordPress WP Job Portal plugin <= 2.5.1 - SQL Injection vulnerability
9.3
CVSS
0.3%
EPSS
No
On KEV
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ahmad WP Job Portal allows Blind SQL Injection.
This issue affects WP Job Portal: from n/a through 2.5.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WJ
WP Job Portal · Ahmad
through 2.5.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-42684
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-42684
patchstack.com
https://patchstack.com/database/wordpress/plugin/wp-job-portal/vulnerability/wordpress-wp-job-portal-plugin-2-5-1-sql-injection-vulnerability?_s_id=cve
More from WP Job Portal
7.1
CVE-2026-42685
WordPress WP Job Portal plugin <= 2.5.1 - Cross Site Scripting (XSS) vulnerability
6.5
CVE-2026-48880
WordPress WP Job Portal plugin <= 2.5.2 - Cross Site Scripting (XSS) vulnerability
4.3
CVE-2026-22386
WordPress WP Job Portal plugin <= 2.7.1 - Broken Access Control vulnerability
4.3
CVE-2026-81299
WordPress WP Job Portal plugin <= 2.5.9 - Insecure Direct Object References (IDOR) vulnerability