The WP Job Portal plugin for WordPress, versions up to and including 2.2.6, contains an insecure direct object reference vulnerability (CWE-639) in the getresumefiledownloadbyid() and getallresumefiles() functions. These functions fail to validate a user-controlled key parameter, enabling unauthenticated attackers to download resume files belonging to other users without authorization. This vulnerability impacts confidentiality but does not affect integrity or availability. The CVSS 3.1 base score is 5.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and limited impact on confidentiality only.

An unauthenticated attacker can exploit this vulnerability to download resume files of users without proper authorization, leading to unauthorized disclosure of potentially sensitive personal information. There is no indication of impact on data integrity or system availability. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin or disable it if possible. Monitor for updates from the WP Job Portal vendor and apply any official patches promptly once released.