# WP Job Portal <= 2.7.2 - Unauthenticated Sensitive Information Exposure via Publicly Accessible Resume Files

- **ID:** WPSEC-2026-2779
- **Plugin:** WP Job Portal – AI-Powered Recruitment System for Company or Job Board website (`wp-job-portal`), https://wordpress.org/plugins/wp-job-portal/
- **Affected versions:** all versions before 2.8.0
- **Fixed in:** 2.8.0 (Update to 2.8.0 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-552
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-10)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-job-portal
- **Fix released:** 2026-11-09
- **Published:** 2026-11-10
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2779/

## Description

The WP Job Portal plugin for WordPress is vulnerable to Sensitive Information Exposure via uploaded resume attachments in all versions up to, and including, 2.7.2, due to resume files and resume custom-field uploads being stored in a publicly reachable uploads folder (data/jobseeker/resume_<id>/resume/) under their original file names, with sequential resume IDs, no index file in that folder and no rule denying direct access. This makes it possible for unauthenticated attackers who can guess or list a file's path to download job seekers' resumes, which may contain personal information, without the plugin's download permission checks.

## References

- https://wpsec.com/vuln/WPSEC-2026-2779/
- https://plugins.svn.wordpress.org/wp-job-portal/tags/2.8.0/
- https://wordpress.org/plugins/wp-job-portal/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2779/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.