The WP Job Portal plugin for WordPress suffers from an authorization bypass vulnerability (CWE-639) in all versions up to 2.2.6. The issue arises in the enforcedelete() function, which fails to validate a user-controlled key parameter, enabling authenticated users with Employer-level privileges or higher to delete companies owned by other users. This insecure direct object reference flaw allows unauthorized modification of data within the application. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity, requiring privileges, no user interaction, and resulting in integrity impact only.

An attacker with authenticated Employer-level access can delete companies belonging to other users, leading to unauthorized data modification. There is no impact on confidentiality or availability reported. This could disrupt business operations or data integrity within the recruitment system but does not allow data disclosure or system downtime.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Employer-level access to trusted users only and monitor for suspicious deletion activity. Avoid granting elevated privileges unnecessarily. Follow vendor channels for updates regarding a patch or official mitigation.