Job Postings <= 2.8.3 - Authenticated (Subscriber+) Sensitive Information Exposure via Uploaded Applicant Files
- ID
- WPSEC-2026-2582
- Plugin
- Job Postings (job-postings)
- Affected
- from 2.3.0 before 2.8.4
- Remediation
- Update to 2.8.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-11-05
- Attack surface
- Job Postings on WPSec AttackSurface
- Fix released
- Published
Description
The Job Postings plugin for WordPress is vulnerable to Sensitive Information Exposure via the job-postings-get-file download endpoint in all versions up to, and including, 2.8.3. This is due to a missing capability check in the handle_download_request() function, which only required the user to be logged in, combined with uploaded applicant files being stored under predictable names made of the upload timestamp and the original file name. This makes it possible for authenticated attackers, with subscriber-level access and above, to download files uploaded by job applicants, such as CVs containing personal information, if they can guess the file name.
References
- https://wpsec.com/vuln/WPSEC-2026-2582/
- https://plugins.svn.wordpress.org/job-postings/tags/2.8.4/
- https://wordpress.org/plugins/job-postings/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS