# Job Openings <= 4.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure via Resume Attachments

- **ID:** WPSEC-2026-3053
- **Plugin:** HireZoot – Job Listings, Career Page & Recruitment Tool (`wp-job-openings`), https://wordpress.org/plugins/wp-job-openings/
- **Affected versions:** all versions before 4.2.1
- **Fixed in:** 4.2.1 (Update to 4.2.1 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-284
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-job-openings
- **Fix released:** 2026-11-12
- **Published:** 2026-11-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3053/

## Description

The HireZoot – Job Listings, Career Page & Recruitment Tool plugin (formerly WP Job Openings) for WordPress is vulnerable to Sensitive Information Exposure via resume attachments in all versions up to, and including, 4.2.0 due to improper access control on attachments uploaded with job applications. These attachments inherit the 'publish' status of their parent application, so WordPress's read check passes for any user with the 'read' capability. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view the details of applicants' resume attachments, including their file URLs, through the REST API media endpoint, and to download the resumes unless the 'Secure uploaded files' setting blocks direct access to the upload folder.

## References

- https://wpsec.com/vuln/WPSEC-2026-3053/
- https://plugins.svn.wordpress.org/wp-job-openings/tags/4.2.1/
- https://wordpress.org/plugins/wp-job-openings/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3053/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.