# Go Fetch Jobs (for WP Job Manager) <= 1.8.5.2 - Authenticated (Subscriber+) Missing Authorization to Feed Import and Template Actions

- **ID:** WPSEC-2026-1465
- **Plugin:** Go Fetch Jobs (for WP Job Manager) (`go-fetch-jobs-wp-job-manager`), https://wordpress.org/plugins/go-fetch-jobs-wp-job-manager/
- **Affected versions:** all versions before 2.0.2.1
- **Fixed in:** 2.0.2.1 (Update to 2.0.2.1 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-22)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/go-fetch-jobs-wp-job-manager
- **Fix released:** 2026-10-21
- **Published:** 2026-10-22
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1465/

## Description

The Go Fetch Jobs (for WP Job Manager) plugin for WordPress is vulnerable to unauthorized access via several AJAX actions (goft_wpjm_load_template_content, goft_wpjm_update_templates_list, goft_wpjm_load_provider_info, goft_wpjm_import_feed and goft_wpjm_toggle_settings) in all versions up to, and including, 1.8.5.2, due to a missing capability check. The handlers only verify the goft_wpjm_nonce nonce, and that nonce is printed on any admin page loaded with the plugin's post_type query parameter, so any logged-in user can obtain it. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the site's saved import templates and their settings, list template names, make the server fetch and parse remote or uploaded job feeds, and overwrite the plugin's cached feed items.

## References

- https://wpsec.com/vuln/WPSEC-2026-1465/
- https://plugins.svn.wordpress.org/go-fetch-jobs-wp-job-manager/tags/2.0.2.1/
- https://wordpress.org/plugins/go-fetch-jobs-wp-job-manager/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1465/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.