{
 "id": "WPSEC-2026-1883",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1883/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1883/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1883/index.md",
 "title": "WP Job Manager <= 2.4.8 - Unauthenticated Sensitive Information Exposure via [job_summary] and [job_apply] Shortcodes",
 "description": "The WP Job Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.8 because the random [job_summary] shortcode did not apply the job listing browse capability and the [job_apply] shortcode did not apply the job listing view capability. This makes it possible for unauthenticated attackers, on sites that restrict browsing or viewing of job listings and display these shortcodes, to view restricted job listings and their application details such as contact email addresses or URLs.",
 "plugin": {
  "slug": "wp-job-manager",
  "name": "WP Job Manager",
  "full_name": "WP Job Manager",
  "wordpress_org": "https://wordpress.org/plugins/wp-job-manager/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-job-manager/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-job-manager"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-863"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": "1.37.0",
    "from_inclusive": true,
    "to": "2.4.9",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 1.37.0 before 2.4.9"
  ]
 },
 "introduced_in": "1.37.0",
 "fixed_in": "2.4.9",
 "remediation": "Update to 2.4.9 or later.",
 "fix_released": "2026-10-28T01:16:18+00:00",
 "published": "2026-10-29T01:48:36+00:00",
 "updated": "2026-10-28T09:20:02.461237+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1883/",
  "https://plugins.svn.wordpress.org/wp-job-manager/tags/2.4.9/",
  "https://wordpress.org/plugins/wp-job-manager/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-job-manager",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "Medium",
  "as_of": "2026-10-29"
 }
}