Go Fetch Jobs (for WP Job Manager) <= 1.8.5.2 - Authenticated (Subscriber+) Missing Authorization to Feed Import and Template Actions
- ID
- WPSEC-2026-1465
- Plugin
- Go Fetch Jobs (for WP Job Manager) (go-fetch-jobs-wp-job-manager)
- Affected
- all versions before 2.0.2.1
- Remediation
- Update to 2.0.2.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Go Fetch Jobs (for WP Job Manager) on WPSec AttackSurface
- Fix released
- Published
Description
The Go Fetch Jobs (for WP Job Manager) plugin for WordPress is vulnerable to unauthorized access via several AJAX actions (goft_wpjm_load_template_content, goft_wpjm_update_templates_list, goft_wpjm_load_provider_info, goft_wpjm_import_feed and goft_wpjm_toggle_settings) in all versions up to, and including, 1.8.5.2, due to a missing capability check. The handlers only verify the goft_wpjm_nonce nonce, and that nonce is printed on any admin page loaded with the plugin's post_type query parameter, so any logged-in user can obtain it. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the site's saved import templates and their settings, list template names, make the server fetch and parse remote or uploaded job feeds, and overwrite the plugin's cached feed items.
References
- https://wpsec.com/vuln/WPSEC-2026-1465/
- https://plugins.svn.wordpress.org/go-fetch-jobs-wp-job-manager/tags/2.0.2.1/
- https://wordpress.org/plugins/go-fetch-jobs-wp-job-manager/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS