The WP Job Portal plugin for WordPress prior to version 2.5.5 fails to verify ownership when returning an employer's contact email associated with a job listing. This allows authenticated users with minimal privileges (subscriber-level) to bypass authorization controls and retrieve private email addresses of other employers by enumerating job IDs. The vulnerability is categorized as CWE-639 (Authorization Bypass Through User-Controlled Key). No CVSS score or patch information is currently available.

Unauthorized disclosure of private employer email addresses can occur, potentially leading to privacy violations or targeted phishing attacks. The vulnerability affects subscriber-level authenticated users, enabling them to access data beyond their authorization scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level user capabilities or monitor for suspicious enumeration activity if possible.