CVE-2026-81299: CWE-639 Authorization Bypass Through User-Controlled Key in Ahmad WP Job Portal

This vulnerability, identified as CVE-2026-81299, affects Ahmad WP Job Portal versions up to 2.5.9. It is an authorization bypass issue caused by Insecure Direct Object References (IDOR) where a user-controlled key can be manipulated to bypass access controls. The CVSS v3.1 base score is 4.3, indicating medium severity, with network attack vector, low attack complexity, requiring privileges, no user interaction, and impact limited to integrity loss. No vendor advisory or patch information is provided, and no known exploits are reported in the wild.

An attacker with some level of privileges could exploit this vulnerability to bypass authorization controls, potentially modifying or accessing data they should not have access to. The impact is limited to integrity loss without confidentiality or availability impact. There are no reports of active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user privileges to the minimum necessary and monitor for suspicious activity related to authorization bypass attempts.