{
 "id": "WPSEC-2026-1885",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1885/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1885/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1885/index.md",
 "title": "WP Job Manager <= 2.4.8 - Unauthenticated Missing Authorization to Limited File Upload via Job Submission Form",
 "description": "The WP Job Manager plugin for WordPress is vulnerable to Missing Authorization via the job submission form in all versions up to, and including, 2.4.8. This is due to the submit handler reading the posted fields, which uploads any attached files, before checking the nonce, the submit action or whether the user may post or edit a listing. This makes it possible for unauthenticated attackers to upload files of the form's allowed types to the server even when the site does not allow them to post listings. Logged-in users who are blocked from posting by the 'job_manager_user_can_post_job' filter can also submit listings.",
 "plugin": {
  "slug": "wp-job-manager",
  "name": "WP Job Manager",
  "full_name": "WP Job Manager",
  "wordpress_org": "https://wordpress.org/plugins/wp-job-manager/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-job-manager/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-job-manager"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.4.9",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.4.9"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.4.9",
 "remediation": "Update to 2.4.9 or later.",
 "fix_released": "2026-10-28T01:16:18+00:00",
 "published": "2026-10-29T01:48:36+00:00",
 "updated": "2026-10-28T09:20:02.461237+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1885/",
  "https://plugins.svn.wordpress.org/wp-job-manager/tags/2.4.9/",
  "https://wordpress.org/plugins/wp-job-manager/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-job-manager",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "Medium",
  "as_of": "2026-10-29"
 }
}