The WP Job Portal plugin for WordPress, versions up to 2.2.2, contains an SQL Injection vulnerability (CWE-89) in the wpjobportal_deactivate() function via the 'page_id' parameter. The issue arises from insufficient escaping of user-supplied input and lack of proper query preparation, enabling authenticated administrators to append malicious SQL commands to existing queries. This can lead to unauthorized disclosure of sensitive information from the database. The CVSS 3.1 base score is 4.9, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability.

An attacker with Administrator-level access can exploit this vulnerability to perform SQL Injection attacks, potentially extracting sensitive information from the database. There is no indication of impact on data integrity or system availability. The vulnerability does not appear to be exploited in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Administrator-level access to trusted users only and monitor for suspicious activity related to the wpjobportal_deactivate() function. Avoid exposing the vulnerable parameter to untrusted input. Do not rely on generic mitigations; wait for vendor-provided patches or official workarounds.