{
 "id": "WPSEC-2026-2779",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2779/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2779/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2779/index.md",
 "title": "WP Job Portal <= 2.7.2 - Unauthenticated Sensitive Information Exposure via Publicly Accessible Resume Files",
 "description": "The WP Job Portal plugin for WordPress is vulnerable to Sensitive Information Exposure via uploaded resume attachments in all versions up to, and including, 2.7.2, due to resume files and resume custom-field uploads being stored in a publicly reachable uploads folder (data/jobseeker/resume_<id>/resume/) under their original file names, with sequential resume IDs, no index file in that folder and no rule denying direct access. This makes it possible for unauthenticated attackers who can guess or list a file's path to download job seekers' resumes, which may contain personal information, without the plugin's download permission checks.",
 "plugin": {
  "slug": "wp-job-portal",
  "name": "WP Job Portal",
  "full_name": "WP Job Portal – AI-Powered Recruitment System for Company or Job Board website",
  "wordpress_org": "https://wordpress.org/plugins/wp-job-portal/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-job-portal/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-job-portal"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-552"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.8.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.8.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.8.0",
 "remediation": "Update to 2.8.0 or later.",
 "fix_released": "2026-11-09T08:47:42+00:00",
 "published": "2026-11-10T09:43:43+00:00",
 "updated": "2026-11-09T23:34:47.159995+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2779/",
  "https://plugins.svn.wordpress.org/wp-job-portal/tags/2.8.0/",
  "https://wordpress.org/plugins/wp-job-portal/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-job-portal",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-10"
 }
}