# Job Postings <= 2.8.3 - Authenticated (Subscriber+) Sensitive Information Exposure via Uploaded Applicant Files

- **ID:** WPSEC-2026-2582
- **Plugin:** Job Postings (`job-postings`), https://wordpress.org/plugins/job-postings/
- **Affected versions:** from 2.3.0 before 2.8.4
- **Fixed in:** 2.8.4 (Update to 2.8.4 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-11-05)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/job-postings
- **Fix released:** 2026-11-04
- **Published:** 2026-11-05
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2582/

## Description

The Job Postings plugin for WordPress is vulnerable to Sensitive Information Exposure via the job-postings-get-file download endpoint in all versions up to, and including, 2.8.3. This is due to a missing capability check in the handle_download_request() function, which only required the user to be logged in, combined with uploaded applicant files being stored under predictable names made of the upload timestamp and the original file name. This makes it possible for authenticated attackers, with subscriber-level access and above, to download files uploaded by job applicants, such as CVs containing personal information, if they can guess the file name.

## References

- https://wpsec.com/vuln/WPSEC-2026-2582/
- https://plugins.svn.wordpress.org/job-postings/tags/2.8.4/
- https://wordpress.org/plugins/job-postings/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2582/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.