# easy.jobs <= 2.8.4 - Unauthenticated Sensitive Information Exposure via Job Details Shortcode

- **ID:** WPSEC-2026-1826
- **Plugin:** easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution (`easyjobs`), https://wordpress.org/plugins/easyjobs/
- **Affected versions:** all versions before 2.8.5
- **Fixed in:** 2.8.5 (Update to 2.8.5 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-28)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/easyjobs
- **Fix released:** 2026-10-27
- **Published:** 2026-10-28
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1826/

## Description

The easy.jobs plugin for WordPress is vulnerable to Sensitive Information Exposure via the job details shortcode in all versions up to, and including, 2.8.4. This is due to the shortcode rendering jobs regardless of their status, without checking that the job is published. This makes it possible for unauthenticated attackers to view the contents of draft and archived job postings that were not intended to be public.

## References

- https://wpsec.com/vuln/WPSEC-2026-1826/
- https://plugins.svn.wordpress.org/easyjobs/tags/2.8.5/
- https://wordpress.org/plugins/easyjobs/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1826/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.