The WP Job Portal plugin for WordPress suffers from an SQL Injection vulnerability (CWE-89) in versions up to 2.2.2 due to insufficient escaping of user-supplied input in the 'fieldfor', 'visibleParent', and 'id' parameters. Authenticated attackers with Administrator-level access can append malicious SQL queries to existing database queries, potentially extracting sensitive information. The CVSS 3.1 base score is 4.9 (medium), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability. No patch or official remediation guidance has been published yet.

An attacker with Administrator-level access can exploit this vulnerability to perform SQL Injection attacks, enabling unauthorized disclosure of sensitive information from the database. The vulnerability does not affect the integrity or availability of the system but compromises confidentiality. Because exploitation requires high privileges, the risk is limited to users who already have elevated access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Administrator-level access to trusted users only and monitor for suspicious activity related to the affected parameters. Avoid exposing the vulnerable plugin to untrusted users. No official patch or temporary fix has been published at this time.