# WP Job Manager <= 2.4.8 - Unauthenticated Missing Authorization to Limited File Upload via Job Submission Form

- **ID:** WPSEC-2026-1885
- **Plugin:** WP Job Manager (`wp-job-manager`), https://wordpress.org/plugins/wp-job-manager/
- **Affected versions:** all versions before 2.4.9
- **Fixed in:** 2.4.9 (Update to 2.4.9 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin High, affected versions Medium (as of 2026-10-29)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-job-manager
- **Fix released:** 2026-10-28
- **Published:** 2026-10-29
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1885/

## Description

The WP Job Manager plugin for WordPress is vulnerable to Missing Authorization via the job submission form in all versions up to, and including, 2.4.8. This is due to the submit handler reading the posted fields, which uploads any attached files, before checking the nonce, the submit action or whether the user may post or edit a listing. This makes it possible for unauthenticated attackers to upload files of the form's allowed types to the server even when the site does not allow them to post listings. Logged-in users who are blocked from posting by the 'job_manager_user_can_post_job' filter can also submit listings.

## References

- https://wpsec.com/vuln/WPSEC-2026-1885/
- https://plugins.svn.wordpress.org/wp-job-manager/tags/2.4.9/
- https://wordpress.org/plugins/wp-job-manager/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1885/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.