The WP Job Portal plugin for WordPress contains an insecure direct object reference vulnerability (CWE-639) in the deleteUserPhoto() function. This flaw allows authenticated users with low privileges (Subscriber-level and above) to bypass authorization controls and remove profile photos from other users by manipulating a user-controlled key parameter. The vulnerability affects all versions up to and including 2.2.8. Notably, the exploit only removes the photo reference but does not delete the physical photo file from the server.

An attacker with Subscriber-level access or higher can remove profile photos from other users' accounts without proper authorization. This impacts the integrity of user profile data but does not affect confidentiality or availability, nor does it delete the actual photo files. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level permissions where possible and monitor for suspicious activity related to profile photo modifications. Avoid granting unnecessary privileges to users. Follow vendor updates closely for any released patches.