CVE-2024-13371 describes a missing authorization vulnerability in the WP Job Portal – AI-Powered Recruitment System for WordPress. The issue lies in the sendEmailToJobSeeker() function, which lacks proper capability checks, enabling unauthenticated users to send arbitrary emails via the affected website's mail server. This vulnerability affects all versions up to and including 2.2.6. The CVSS 3.1 base score is 5.3, reflecting a medium impact primarily on integrity due to unauthorized email sending. No patch or remediation details are currently available from the vendor or advisory sources.

An attacker can exploit this vulnerability to send arbitrary emails from the affected WordPress site without authentication. This could be used to conduct phishing, spam, or other malicious email campaigns leveraging the trusted domain of the compromised site. There is no direct impact on confidentiality or availability reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, site administrators should consider disabling or restricting access to the affected sendEmailToJobSeeker() functionality or applying custom access controls to prevent unauthenticated email sending. Monitoring for unusual email activity from the site is also advisable.