Vulnerabilities / easy.jobs / WPSEC-2026-1826
easy.jobs <= 2.8.4 - Unauthenticated Sensitive Information Exposure via Job Details Shortcode
Medium 5.3
CWE-200Fixed in 2.8.5
- ID
- WPSEC-2026-1826
- Plugin
- easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution (easyjobs)
- Affected
- all versions before 2.8.5
- Remediation
- Update to 2.8.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-28
- Attack surface
- easy.jobs on WPSec AttackSurface
- Fix released
- Published
Description
The easy.jobs plugin for WordPress is vulnerable to Sensitive Information Exposure via the job details shortcode in all versions up to, and including, 2.8.4. This is due to the shortcode rendering jobs regardless of their status, without checking that the job is published. This makes it possible for unauthenticated attackers to view the contents of draft and archived job postings that were not intended to be public.
References
- https://wpsec.com/vuln/WPSEC-2026-1826/
- https://plugins.svn.wordpress.org/easyjobs/tags/2.8.5/
- https://wordpress.org/plugins/easyjobs/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS