The WP Job Portal plugin for WordPress suffers from an authorization bypass vulnerability classified as CWE-639 (Authorization Bypass Through User-Controlled Key). The issue arises because the 'jobenforcedelete' function does not properly validate a user-controlled key parameter, allowing authenticated attackers with employer-level privileges or above to delete arbitrary resources. This vulnerability affects all versions up to and including 2.2.6. The CVSS 3.1 base score is 4.3, indicating medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction. No patch or official remediation has been documented in the provided data.

The vulnerability allows authenticated users with employer-level access or higher to delete arbitrary data within the WP Job Portal plugin. This can lead to unauthorized data deletion impacting the integrity of the recruitment system's data. There is no indication of confidentiality or availability impact beyond the deletion capability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict employer-level access to trusted users only and monitor for suspicious deletion activity related to the 'jobenforcedelete' function. Avoid granting unnecessary privileges to users to limit potential exploitation.