CVE-2026-4306: 
WordPress vulnerability analysis and mitigation

CVE-2026-4306 is a SQL Injection vulnerability in the WP Job Portal plugin for WordPress, affecting all versions up to and including 2.4.8. The flaw exists in the radius parameter due to insufficient escaping of user-supplied input and lack of proper SQL query preparation, enabling unauthenticated attackers to extract sensitive data from the database. It was published on March 23, 2026, and assigned by Wordfence. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (Wordfence, ENISA EUVD).

The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), classified as a classic SQL injection. The vulnerable radius parameter is processed in modules/job/model.php (line 2743) and exposed via includes/ajax.php (line 10), where user input is neither properly escaped nor passed through prepared statements before being incorporated into SQL queries. Because the vulnerable endpoint is accessible without authentication, attackers can append arbitrary SQL clauses to existing queries to enumerate or dump database contents. No authentication or special privileges are required, and attack complexity is low (Wordfence, WP Trac).

Successful exploitation allows unauthenticated remote attackers to extract sensitive information from the WordPress database, including user credentials (hashed passwords), email addresses, plugin configuration data, and potentially other stored secrets. The confidentiality impact is rated High, while integrity and availability are unaffected by this specific vector. Depending on the database user's privileges, attackers may also be able to read files from the server or escalate further within the environment (Wordfence, ENISA EUVD).

No public exploit code or active in-the-wild exploitation has been confirmed as of the available data. The EPSS score is approximately 0.071% (0.000710), indicating a currently low probability of exploitation in the near term. The vulnerability is detectable by Qualys (detection ID 531234) and has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the unauthenticated, network-accessible nature of the flaw makes it attractive for automated scanning and exploitation (Wordfence, ENISA EUVD).

1. Reconnaissance: Identify WordPress sites running WP Job Portal ≤ 2.4.8 using tools like WPScan, Shodan, or by checking the plugin's readme.txt file at https://target.com/wp-content/plugins/wp-job-portal/readme.txt.
2. Locate the vulnerable endpoint: The SQL injection is triggered via the AJAX handler exposed in includes/ajax.php. Identify the relevant AJAX action that processes the radius parameter (typically accessible via wp-admin/admin-ajax.php or a public-facing endpoint).
3. Craft the injection payload: Append SQL injection syntax to the radius parameter, e.g., radius=10 UNION SELECT 1,user(),database(),4-- or use time-based blind injection such as radius=10 AND SLEEP(5)-- to confirm exploitability.
4. Extract data: Use tools like sqlmap targeting the vulnerable parameter: sqlmap -u "https://target.com/wp-admin/admin-ajax.php" --data="action=<ajax_action>&radius=10" -p radius --dbs to enumerate databases and extract tables such as wp_users.
5. Retrieve credentials: Dump the wp_users table to obtain usernames and hashed passwords, which can then be cracked offline or used for further access (Wordfence, WP Trac).

• Network: Unusual or repeated HTTP POST/GET requests to wp-admin/admin-ajax.php containing SQL keywords (UNION, SELECT, SLEEP, BENCHMARK, --, ') in the radius parameter; high-frequency requests from a single IP to job search endpoints.
• Logs: Web server access logs showing requests with encoded or plaintext SQL payloads in the radius field; abnormally long query strings or error responses from the database layer in WordPress debug logs.
• File System: No direct file artifacts expected from read-only SQL injection, but monitor for subsequent web shell uploads if the database user has FILE privileges.
• Process: Unexpected database queries involving UNION SELECT or INFORMATION_SCHEMA visible in MySQL/MariaDB slow query or general query logs.

Users should upgrade the WP Job Portal plugin to version 2.4.9 or later, which addresses the SQL injection by properly escaping the radius parameter and using prepared statements. The fix is documented in the plugin's changeset between tags 2.4.8 and 2.4.9. As an interim workaround, site administrators can use a Web Application Firewall (WAF) rule to block SQL injection patterns in the radius parameter, or temporarily disable the plugin until patching is feasible (WP Trac Changeset, Wordfence).

Wordfence included CVE-2026-4306 in their weekly WordPress vulnerability report for the period of March 23–29, 2026, highlighting it among notable plugin vulnerabilities. RedPacketSecurity shared an alert on Mastodon, and the CVE was noted on Bluesky via automated CVE tracking accounts. Coverage has been largely automated aggregation with no significant independent researcher commentary or vendor statements beyond the Wordfence advisory (Wordfence Blog, RedPacketSecurity).