WP Job Manager <= 2.4.8 - Unauthenticated Missing Authorization to Limited File Upload via Job Submission Form
- ID
- WPSEC-2026-1885
- Plugin
- WP Job Manager (wp-job-manager)
- Affected
- all versions before 2.4.9
- Remediation
- Update to 2.4.9 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin High · Affected versions Medium among sites WPSec scans, 2026-10-29
- Attack surface
- WP Job Manager on WPSec AttackSurface
- Fix released
- Published
Description
The WP Job Manager plugin for WordPress is vulnerable to Missing Authorization via the job submission form in all versions up to, and including, 2.4.8. This is due to the submit handler reading the posted fields, which uploads any attached files, before checking the nonce, the submit action or whether the user may post or edit a listing. This makes it possible for unauthenticated attackers to upload files of the form's allowed types to the server even when the site does not allow them to post listings. Logged-in users who are blocked from posting by the 'job_manager_user_can_post_job' filter can also submit listings.
References
- https://wpsec.com/vuln/WPSEC-2026-1885/
- https://plugins.svn.wordpress.org/wp-job-manager/tags/2.4.9/
- https://wordpress.org/plugins/wp-job-manager/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS