Wp Job Openings Vulnerabilities

[en] Missing Authorization vulnerability in AWSM Innovations WP Job Openings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Openings: from n/a through 3.4.1.

Affected:

up to 3.4.2

Fixed in:

3.4.2

Disclosed:

Jan 2, 2025

CVE-2023-45061 on NVD →

[en] The WP Job Openings WordPress plugin before 3.4.3 does not block listing the contents of the directories where it stores attachments to job applications, allowing unauthenticated visitors to list and download private attachments if the autoindex feature of the web server is enabled.

Affected:

up to 3.4.3

Fixed in:

3.4.3

Disclosed:

Oct 16, 2023

CVE-2023-4933 on NVD →

The WP Job Openings plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the insert_application() function in versions up to, and including, 3.4.1. This makes it possible for unauthenticated attackers to submit applications on unpublished jobs.

CVSS:

5.3

Affected:

up to 3.4.1

Fixed in:

3.4.2

Disclosed:

Oct 3, 2023

CVE-2023-45061 on NVD →

The WP Job Openings plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.4.2 due to lack of an index file in storage directories. This can allow unauthenticated attackers to extract sensitive data including uploaded resumes and job applications if Directory Listing is...

CVSS:

3.7

Affected:

up to 3.4.2

Fixed in:

3.4.3

Disclosed:

Sep 25, 2023

CVE-2023-4933 on NVD →