CVE-2024-12131 is an authorization bypass vulnerability in the WP Job Portal plugin for WordPress, affecting all versions up to 2.2.5. The issue arises from insecure direct object references caused by missing validation on a user-controlled key, enabling authenticated users with Subscriber-level privileges or above to impersonate other applicants by submitting resumes on their behalf. The vulnerability is classified under CWE-639 and has a CVSS 3.1 base score of 4.3, indicating medium severity. No patch or remediation guidance is currently provided, and the plugin is not a cloud service.

An attacker with at least Subscriber-level access can exploit this vulnerability to submit resumes for other users without authorization. This could lead to unauthorized manipulation of application data and potential disruption of recruitment processes. There is no indication of confidentiality or availability impact, and no known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level access to trusted users only and monitor for suspicious activity related to resume submissions. Avoid granting unnecessary privileges to users and consider disabling the plugin if the risk is unacceptable.