# WP Job Manager <= 2.4.8 - Unauthenticated Sensitive Information Exposure via [job_summary] and [job_apply] Shortcodes

- **ID:** WPSEC-2026-1883
- **Plugin:** WP Job Manager (`wp-job-manager`), https://wordpress.org/plugins/wp-job-manager/
- **Affected versions:** from 1.37.0 before 2.4.9
- **Fixed in:** 2.4.9 (Update to 2.4.9 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-863
- **Usage among sites WPSec scans:** plugin High, affected versions Medium (as of 2026-10-29)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-job-manager
- **Fix released:** 2026-10-28
- **Published:** 2026-10-29
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1883/

## Description

The WP Job Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.8 because the random [job_summary] shortcode did not apply the job listing browse capability and the [job_apply] shortcode did not apply the job listing view capability. This makes it possible for unauthenticated attackers, on sites that restrict browsing or viewing of job listings and display these shortcodes, to view restricted job listings and their application details such as contact email addresses or URLs.

## References

- https://wpsec.com/vuln/WPSEC-2026-1883/
- https://plugins.svn.wordpress.org/wp-job-manager/tags/2.4.9/
- https://wordpress.org/plugins/wp-job-manager/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1883/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.