WP Job Portal <= 2.7.2 - Unauthenticated Sensitive Information Exposure via Publicly Accessible Resume Files
- ID
- WPSEC-2026-2779
- Plugin
- WP Job Portal – AI-Powered Recruitment System for Company or Job Board website (wp-job-portal)
- Affected
- all versions before 2.8.0
- Remediation
- Update to 2.8.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-552
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-10
- Attack surface
- WP Job Portal on WPSec AttackSurface
- Fix released
- Published
Description
The WP Job Portal plugin for WordPress is vulnerable to Sensitive Information Exposure via uploaded resume attachments in all versions up to, and including, 2.7.2, due to resume files and resume custom-field uploads being stored in a publicly reachable uploads folder (data/jobseeker/resume_<id>/resume/) under their original file names, with sequential resume IDs, no index file in that folder and no rule denying direct access. This makes it possible for unauthenticated attackers who can guess or list a file's path to download job seekers' resumes, which may contain personal information, without the plugin's download permission checks.
References
- https://wpsec.com/vuln/WPSEC-2026-2779/
- https://plugins.svn.wordpress.org/wp-job-portal/tags/2.8.0/
- https://wordpress.org/plugins/wp-job-portal/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS