Job Openings <= 4.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure via Resume Attachments
- ID
- WPSEC-2026-3053
- Plugin
- HireZoot – Job Listings, Career Page & Recruitment Tool (wp-job-openings)
- Affected
- all versions before 4.2.1
- Remediation
- Update to 4.2.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-284
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-13
- Attack surface
- Job Openings on WPSec AttackSurface
- Fix released
- Published
Description
The HireZoot – Job Listings, Career Page & Recruitment Tool plugin (formerly WP Job Openings) for WordPress is vulnerable to Sensitive Information Exposure via resume attachments in all versions up to, and including, 4.2.0 due to improper access control on attachments uploaded with job applications. These attachments inherit the 'publish' status of their parent application, so WordPress's read check passes for any user with the 'read' capability. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view the details of applicants' resume attachments, including their file URLs, through the REST API media endpoint, and to download the resumes unless the 'Secure uploaded files' setting blocks direct access to the upload folder.
References
- https://wpsec.com/vuln/WPSEC-2026-3053/
- https://plugins.svn.wordpress.org/wp-job-openings/tags/4.2.1/
- https://wordpress.org/plugins/wp-job-openings/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS