Vulnerabilities / WP Job Manager / WPSEC-2026-1883
WP Job Manager <= 2.4.8 - Unauthenticated Sensitive Information Exposure via [job_summary] and [job_apply] Shortcodes
Low 3.7
CWE-863Fixed in 2.4.9
- ID
- WPSEC-2026-1883
- Plugin
- WP Job Manager (wp-job-manager)
- Affected
- from 1.37.0 before 2.4.9
- Remediation
- Update to 2.4.9 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-863
- Usage
- Plugin High · Affected versions Medium among sites WPSec scans, 2026-10-29
- Attack surface
- WP Job Manager on WPSec AttackSurface
- Fix released
- Published
Description
The WP Job Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.8 because the random [job_summary] shortcode did not apply the job listing browse capability and the [job_apply] shortcode did not apply the job listing view capability. This makes it possible for unauthenticated attackers, on sites that restrict browsing or viewing of job listings and display these shortcodes, to view restricted job listings and their application details such as contact email addresses or URLs.
References
- https://wpsec.com/vuln/WPSEC-2026-1883/
- https://plugins.svn.wordpress.org/wp-job-manager/tags/2.4.9/
- https://wordpress.org/plugins/wp-job-manager/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS