{
 "id": "WPSEC-2026-3053",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3053/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3053/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3053/index.md",
 "title": "Job Openings <= 4.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure via Resume Attachments",
 "description": "The HireZoot – Job Listings, Career Page & Recruitment Tool plugin (formerly WP Job Openings) for WordPress is vulnerable to Sensitive Information Exposure via resume attachments in all versions up to, and including, 4.2.0 due to improper access control on attachments uploaded with job applications. These attachments inherit the 'publish' status of their parent application, so WordPress's read check passes for any user with the 'read' capability. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view the details of applicants' resume attachments, including their file URLs, through the REST API media endpoint, and to download the resumes unless the 'Secure uploaded files' setting blocks direct access to the upload folder.",
 "plugin": {
  "slug": "wp-job-openings",
  "name": "Job Openings",
  "full_name": "HireZoot – Job Listings, Career Page & Recruitment Tool",
  "wordpress_org": "https://wordpress.org/plugins/wp-job-openings/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-job-openings/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-job-openings"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-284"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.2.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.2.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.2.1",
 "remediation": "Update to 4.2.1 or later.",
 "fix_released": "2026-11-12T11:45:40+00:00",
 "published": "2026-11-13T11:47:18+00:00",
 "updated": "2026-11-12T17:15:51.583023+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3053/",
  "https://plugins.svn.wordpress.org/wp-job-openings/tags/4.2.1/",
  "https://wordpress.org/plugins/wp-job-openings/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-job-openings",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-13"
 }
}